Sign in on the mail server's own page (OAuth with PKCE), sessions hold tokens; tenants on every edition

Contract C-8 and C-10: with OAUTH_CLIENT_SECRET set, sign-in goes through the
server's page and the session keeps sealed tokens, renewed before they expire,
instead of a password. Push keeps a credential that renews itself. A password
change signs the session out, since the server revokes its tokens. The mock
answers OAuth for tests and development. Eleven new strings, in all nine
catalogues.

web/src/locales/zh-Hans.ts

@@ -1222,6 +1222,17 @@ export const catalog: Catalog = {
     "Could not save filters: {error}": "无法保存过滤器：{error}",
     "Could not send the receipt: {error}": "无法发送已读回执：{error}",
     "Could not sign in.": "无法登录。",
+    "You'll enter your password on your mail server's sign-in page.": "您将在邮件服务器的登录页面上输入密码。",
+    "This sign-in didn't start in this browser. Try again.": "此次登录不是在这个浏览器中发起的。请重试。",
+    "The sign-in took too long. Try again.": "登录耗时过长。请重试。",
+    "Sign-in was cancelled.": "登录已取消。",
+    "The mail server didn't accept the sign-in. Try again.": "邮件服务器未接受此次登录。请重试。",
+    "That account is on a different mail server than the address you entered. Sign in with that address.": "该账户所在的邮件服务器与您输入的地址不同。请使用该地址登录。",
+    "This mail server isn't supported.": "不支持此邮件服务器。",
+    "Couldn't reach the mail server. Try again in a moment.": "无法连接邮件服务器。请稍后重试。",
+    "Your password was changed. Sign in with the new one.": "您的密码已更改。请使用新密码登录。",
+    "Your sign-in ended. Sign in again.": "您的登录已结束。请重新登录。",
+    "Changing your password signs you out everywhere, here included, and you sign in again with the new one. Any app passwords keep working.": "更改密码会让您在所有地方退出登录（包括这里），然后需用新密码重新登录。已有的应用专用密码仍可继续使用。",
     "Could not store image: {error}": "无法保存图片：{error}",
     "Could not update labels: {error}": "无法更新标签：{error}",
     "Could not update the Scheduled folder: {error}": "无法更新「定时发送」文件夹：{error}",