Add Roles to Administration, with Stalwart's permissions in every language

A role is a named set of permissions given to accounts, groups and
tenants. It gets its own section under a new Access heading: every role
listed with the permissions it grants once its bases are followed, and a
panel to create, edit and delete one.

A role builds on others and has everything they grant; a denial anywhere in
the tree wins, which is how Stalwart resolves it (permissions.rs unions
enabled and disabled across the tree, then subtracts). The picker is
Stalwart's own list of permissions, under its headings, searchable and
filterable to what is granted or set here. Each permission is not set,
allowed or denied, and one that is inherited says which role it comes from.
Only permissions the viewer holds can be allowed, because Stalwart refuses
the rest, and a role carrying anything the viewer lacks opens read-only with
no delete, because Stalwart checks a grant but not a delete. Saving sends a
pointer for each permission and base role that changed.

The roles Stalwart hands out by default, read from x:Authentication, say so
before they are changed and cannot be deleted here; a role still in use is
kept by the server, and the refusal names what uses it.

The permission list is Stalwart's schema. A new route, GET
/api/admin/permissions, fetches /api/schema as the signed-in account and
returns only names and labels, behind the same two gates as the registry
methods and held in memory for an hour. Its labels are English only, so
every one of the 661 has a translation in each of the eight other
languages, in its own file keyed by permission name and loaded only when
Roles opens. A permission a later Stalwart adds shows its English label. A
test holds every language to the 0.16.22 snapshot: nothing missing, nothing
stale.

The mock answers x:Role/set with the grant check, loops and in-use
refusals, reads the defaults from x:Authentication, and serves the schema
gzipped as the real one is.

Fifty-two new strings and two plurals in all nine catalogues, and 661
permission labels with 59 headings in each of the eight translations.

web/src/locales/es.ts

@@ -199,6 +199,58 @@ export const catalog: Catalog = {
     "Your organisation has reached the number of mailing lists it is allowed.": "Su organización ha alcanzado el número de listas de correo permitido.",
     "This mailing list no longer exists. Someone may have deleted it.": "Esta lista de correo ya no existe. Puede que alguien la haya eliminado.",
     "The server did not say whether the list was created.": "El servidor no indicó si la lista se creó.",
+    "Roles": "Roles",
+    "users": "usuarios",
+    "groups": "grupos",
+    "tenant administrators": "administradores de inquilino",
+    "administrators": "administradores",
+    "A role needs a name.": "Un rol necesita un nombre.",
+    "Created {name}": "{name} creado",
+    "New role": "Nuevo rol",
+    "This role carries permissions yours doesn't, so you can view it but not change it.": "Este rol tiene permisos que el suyo no tiene, así que puede verlo pero no modificarlo.",
+    "Your role lets you view roles but not change them.": "Su rol le permite ver los roles, pero no modificarlos.",
+    "Stalwart gives this role by default to {kinds}. A change here reaches everyone who has it that way.": "Stalwart asigna este rol de forma predeterminada a {kinds}. Un cambio aquí afecta a todos los que lo tienen de esa forma.",
+    "Builds on": "Se basa en",
+    "Permissions": "Permisos",
+    "Stalwart gives this role by default, so it can't be deleted. Change the defaults in Stalwart's own administration first.": "Stalwart asigna este rol de forma predeterminada, así que no se puede eliminar. Cambie primero los valores predeterminados en la administración de Stalwart.",
+    "This role carries permissions yours doesn't.": "Este rol tiene permisos que el suyo no tiene.",
+    "Create role": "Crear rol",
+    "builds on this one": "se basa en este",
+    "has permissions yours doesn't": "tiene permisos que el suyo no tiene",
+    "No other roles": "No hay otros roles",
+    "A role has every permission of the roles it builds on, apart from any it or they deny.": "Un rol tiene todos los permisos de los roles en los que se basa, salvo los que él o ellos denieguen.",
+    "Search permissions": "Buscar permisos",
+    "All permissions": "Todos los permisos",
+    "Granted": "Concedidos",
+    "Set on this role": "Definidos en este rol",
+    "No permissions match": "Ningún permiso coincide",
+    "{granted} of {total}": "{granted} de {total}",
+    "Denied by {role}": "Denegado por {role}",
+    "Granted by {role}": "Concedido por {role}",
+    "Inherit": "Heredar",
+    "Not set": "Sin definir",
+    "Allow": "Permitir",
+    "Deny": "Denegar",
+    "A denial wins over anything allowed, here or on a role this one builds on. You can only allow permissions you hold yourself.": "Una denegación prevalece sobre cualquier permiso, aquí o en un rol en el que este se basa. Solo puede permitir permisos que usted mismo tenga.",
+    "Accounts, groups and other roles that use it must be moved off it first.": "Las cuentas, grupos y otros roles que lo usan deben quitárselo primero.",
+    "Delete role…": "Eliminar rol…",
+    "Deleted {name}": "{name} eliminado",
+    "Still used by {things}. Move them to another role first.": "Aún lo usan {things}. Asígneles otro rol primero.",
+    "Delete role": "Eliminar rol",
+    "It can't be undone.": "No se puede deshacer.",
+    "Type {name} to confirm": "Escriba {name} para confirmar",
+    "Stalwart's list of permissions could not be loaded, so permissions can't be changed here. ({reason})": "No se pudo cargar la lista de permisos de Stalwart, así que aquí no se pueden cambiar los permisos. ({reason})",
+    "Named sets of permissions, given to accounts, groups and tenants.": "Conjuntos de permisos con nombre, asignados a cuentas, grupos e inquilinos.",
+    "Search roles": "Buscar roles",
+    "No roles match": "Ningún rol coincide",
+    "No roles yet": "Aún no hay roles",
+    "Open {name}": "Abrir {name}",
+    "Default for {kinds}": "Predeterminado para {kinds}",
+    "You can't give a role permissions your own role doesn't have.": "No puede dar a un rol permisos que su propio rol no tiene.",
+    "Your organisation has reached the number of roles it is allowed.": "Su organización ha alcanzado el número de roles permitido.",
+    "This role no longer exists. Someone may have deleted it.": "Este rol ya no existe. Puede que alguien lo haya eliminado.",
+    "the default roles": "los roles predeterminados",
+    "The server did not say whether the role was created.": "El servidor no indicó si el rol se creó.",
     "User": "Usuario",
     "Administrator": "Administrador",
     "Custom role": "Rol personalizado",
@@ -1595,6 +1647,8 @@ export const catalog: Catalog = {
     "Its {n} members are taken out of the group first, and lose what was shared with it. The group's own mail is removed in the background, and it can't be undone.": { one: "Primero se quita del grupo a su {n} miembro, que pierde lo que se compartía con él. El correo del grupo se elimina en segundo plano, y no se puede deshacer.", other: "Primero se quita del grupo a sus {n} miembros, que pierden lo que se compartía con él. El correo del grupo se elimina en segundo plano, y no se puede deshacer." },
     "{n} mailing lists": { one: "{n} lista de correo", other: "{n} listas de correo" },
     "{n} recipients": { one: "{n} destinatario", other: "{n} destinatarios" },
+    "Grants {n} permissions": { one: "Concede {n} permiso", other: "Concede {n} permisos" },
+    "{n} roles": { one: "{n} rol", other: "{n} roles" },
     "{n} DKIM keys": { one: "{n} clave DKIM", other: "{n} claves DKIM" },
     "{n} other items": { one: "{n} elemento más", other: "{n} elementos más" },
     // ── Administration ────────────────────────────────────────────────