Restore administrator roles that migrate_v016.py drops

Chased down why a migrated instance had no working administrator. The
account authenticated fine and was refused every management call, and the
cause is that migrate_v016.py assigns every migrated account the User role
regardless of what it held before: an account that was `roles: ["admin"]`
in v0.15 comes out the far side as `roles: {"@type": "User"}`.

Ordinary users were never affected - User is what they had and what they
get - and their credentials, mail and mailboxes survive untouched. It is
specifically administrators who lose their privileges, which is a bad thing
to discover after cutting over.

The v0.16 shape came from the server's own schema document rather than the
published reference: GET /api/schema defines x:UserRoles as a multi-variant
type with variants User, Admin and Custom. Account is itself multi-variant,
so an upsert needs its own "@type" too - without it the server rejects the
operation outright ("upsert entry is missing `@type`").

applyplan.AccountRoleOperations restores roles from the principals dump,
emitting operations only for accounts whose role actually changes.
Rewriting every account would be a much larger blast radius for no benefit.
Where v0.15 listed several roles, admin wins - under-privileging an
administrator locks them out, which is the failure being fixed - and the
collapse is reported rather than done silently, as are roles with no known
v0.16 equivalent.

Verified end to end on the smoke VM: rehearse against the real 0.15.5 put
the role operation in the supplement, applying that supplement to a
migrated 0.16.14 whose admin was broken restored management access
(accounts=3), and alice and bob logged in over IMAPS with unchanged
credentials, read their mail, and accepted new SMTP delivery.

Also recorded: x:Account.domainId returns an internal id on v0.16, not a
domain name, so the post-migration directory comparison would read every
domain as missing. Resolving that needs an x:Domain/get call not yet
confirmed against the binary.

internal/backup/settingsdump.go

@@ -312,3 +312,28 @@ func ReadUnmigratedKeys(reportPath string, settings map[string]string) (map[stri
 	}
 	return keys, nil
 }
+
+// Principal is the subset of a v0.15 principals dump this tool needs. The
+// shape is what the REST management API returns and what
+// migrate_v016.py's dump step writes out verbatim.
+type Principal struct {
+	ID     int      `json:"id"`
+	Type   string   `json:"type"` // "individual", "group", "domain", ...
+	Name   string   `json:"name"`
+	Emails []string `json:"emails"`
+	Roles  []string `json:"roles"`
+}
+
+// ReadPrincipalsDump loads the principals dump written alongside the
+// settings dump.
+func ReadPrincipalsDump(path string) ([]Principal, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("backup: read principals dump %s: %w", path, err)
+	}
+	var principals []Principal
+	if err := json.Unmarshal(data, &principals); err != nil {
+		return nil, fmt.Errorf("backup: parse principals dump %s: %w", path, err)
+	}
+	return principals, nil
+}