Add Tenants to Administration, and let an account be put in one

A tenant is a separate organisation on one server: its own people,
domains and limits, and an administrator who manages only what is in it.
It gets a section under Access, gated by sysTenantQuery and sysTenantGet,
with a notice on a server that does not report Enterprise, where anyone
inside a tenant is held to an ordinary user's permissions.

The panel edits the tenant's name, logo, role and limits. The logo is an
https address, drawn through the image proxy the strict image policy
requires, or an image data URL. Limits change one quotas/<name> pointer
each, so the four ihasmail does not offer keep their values, and an empty
field is no limit. The role is the most anyone inside can be allowed.

Stalwart keeps no list on a tenant -- each account, group, domain, list and
role names its own -- so what a tenant holds is counted with memberTenantId
queries and shown against its limits. Domains are added and taken out from
the tenant's panel, one memberTenantId change each; only a domain in no
tenant can be added, and its accounts stay where they are. Delete is offered
once every count reads zero.

A tenant does nothing until someone administers it, so the account panel
gains a Tenant choice for an administrator who can read tenants: an
Administrator inside a tenant administers that tenant. Nobody moves their
own account.

The mock has a tenant holding a domain and an administrator, a spare domain
to assign, memberTenantId filters on every query, and Stalwart's rule that
only an administrator outside every tenant may move things into one. A test
of taking a domain back out found that the mock's pointer handling dropped a
top-level null instead of storing it, so nothing had ever been cleared that
way; it stores null now, as the server reads it back.

Nothing about tenants has been written on a live server: production has
none. KNOWN-ISSUES says what was read from source.

Thirty-nine new strings and one plural, in all nine catalogues.

web/src/locales/de.ts

@@ -259,6 +259,45 @@ export const catalog: Catalog = {
     "This role no longer exists. Someone may have deleted it.": "Diese Rolle existiert nicht mehr. Jemand hat sie möglicherweise gelöscht.",
     "the default roles": "den Standardrollen",
     "The server did not say whether the role was created.": "Der Server hat nicht mitgeteilt, ob die Rolle angelegt wurde.",
+    "No tenant": "Kein Mandant",
+    "You can't move your own account into a tenant.": "Sie können Ihr eigenes Konto nicht in einen Mandanten verschieben.",
+    "An account in a tenant is limited by the tenant's role and counts towards its limits, and Administrator means administrator of that tenant.": "Ein Konto in einem Mandanten ist durch dessen Rolle begrenzt und zählt zu dessen Limits, und Administrator bedeutet Administrator dieses Mandanten.",
+    "Tenants": "Mandanten",
+    "Storage in GB": "Speicher in GB",
+    "Default tenant roles": "Standardrollen für Mandanten",
+    "A tenant needs a name.": "Ein Mandant braucht einen Namen.",
+    "New tenant": "Neuer Mandant",
+    "{used} used": "{used} belegt",
+    "Your role lets you view tenants but not change them.": "Ihre Rolle erlaubt es, Mandanten anzusehen, aber nicht zu ändern.",
+    "Logo": "Logo",
+    "An https address or a data URL of an image. Stalwart shows it to the tenant's people where it shows a logo.": "Eine https-Adresse oder eine Data-URL eines Bildes. Stalwart zeigt es den Personen des Mandanten dort, wo es ein Logo zeigt.",
+    "What it holds": "Enthält",
+    "{n} of {limit}": "{n} von {limit}",
+    "Limits": "Limits",
+    "Stalwart refuses to create more than a limit allows. An empty field is no limit.": "Stalwart verweigert es, mehr anzulegen, als ein Limit erlaubt. Ein leeres Feld bedeutet kein Limit.",
+    "The most anyone in this tenant can be allowed: their own roles are cut down to what these grant. Only roles whose permissions you hold yourself are offered.": "Das Höchste, was jemandem in diesem Mandanten erlaubt sein kann: Die eigenen Rollen werden auf das beschränkt, was diese gewähren. Angeboten werden nur Rollen, deren Berechtigungen Sie selbst haben.",
+    "Checking what is still in this tenant…": "Es wird geprüft, was noch in diesem Mandanten ist…",
+    "It still holds accounts, domains or other things. Move them out first.": "Er enthält noch Konten, Domains oder anderes. Verschieben Sie diese zuerst.",
+    "Create tenant": "Mandant anlegen",
+    "Added {domain} to {tenant}": "{domain} zu {tenant} hinzugefügt",
+    "Took {domain} out of {tenant}": "{domain} aus {tenant} entfernt",
+    "Take {domain} out of the tenant": "{domain} aus dem Mandanten entfernen",
+    "No domains in this tenant yet": "Noch keine Domains in diesem Mandanten",
+    "Domain to add": "Hinzuzufügende Domain",
+    "Only domains in no tenant can be added. The accounts already on a domain stay where they are; move each from its own panel.": "Nur Domains ohne Mandanten können hinzugefügt werden. Die Konten auf einer Domain bleiben, wo sie sind; verschieben Sie jedes in seinem eigenen Bereich.",
+    "An empty tenant can be deleted.": "Ein leerer Mandant kann gelöscht werden.",
+    "Delete tenant…": "Mandant löschen…",
+    "Still holds {things}. Move them out first.": "Enthält noch {things}. Verschieben Sie diese zuerst.",
+    "Delete tenant": "Mandant löschen",
+    "Separate organisations on one server, each with its own people, domains and limits.": "Getrennte Organisationen auf einem Server, jede mit eigenen Personen, Domains und Limits.",
+    "Tenants are a Stalwart Enterprise feature. This server does not report Enterprise, so anyone inside a tenant has only an ordinary user's permissions.": "Mandanten sind eine Funktion von Stalwart Enterprise. Dieser Server meldet kein Enterprise, daher hat jeder in einem Mandanten nur die Berechtigungen eines normalen Benutzers.",
+    "Search tenants": "Mandanten durchsuchen",
+    "No tenants match": "Keine passenden Mandanten",
+    "No tenants yet": "Noch keine Mandanten",
+    "Account limit": "Kontenlimit",
+    "The server allows no more tenants.": "Der Server erlaubt keine weiteren Mandanten.",
+    "This tenant no longer exists. Someone may have deleted it.": "Dieser Mandant existiert nicht mehr. Jemand hat ihn möglicherweise gelöscht.",
+    "The server did not say whether the tenant was created.": "Der Server hat nicht mitgeteilt, ob der Mandant angelegt wurde.",
     "User": "Benutzer",
     "Administrator": "Administrator",
     "Custom role": "Eigene Rolle",
@@ -1676,6 +1715,7 @@ export const catalog: Catalog = {
     "{n} recipients": { one: "{n} Empfänger", other: "{n} Empfänger" },
     "Grants {n} permissions": { one: "Gewährt {n} Berechtigung", other: "Gewährt {n} Berechtigungen" },
     "{n} roles": { one: "{n} Rolle", other: "{n} Rollen" },
+    "{n} tenants": { one: "{n} Mandant", other: "{n} Mandanten" },
     "{n} DKIM keys": { one: "{n} DKIM-Schlüssel", other: "{n} DKIM-Schlüssel" },
     "{n} other items": { one: "{n} weiteres Objekt", other: "{n} weitere Objekte" },
     // ── Administration ────────────────────────────────────────────────