Add Roles to Administration, with Stalwart's permissions in every language

A role is a named set of permissions given to accounts, groups and
tenants. It gets its own section under a new Access heading: every role
listed with the permissions it grants once its bases are followed, and a
panel to create, edit and delete one.

A role builds on others and has everything they grant; a denial anywhere in
the tree wins, which is how Stalwart resolves it (permissions.rs unions
enabled and disabled across the tree, then subtracts). The picker is
Stalwart's own list of permissions, under its headings, searchable and
filterable to what is granted or set here. Each permission is not set,
allowed or denied, and one that is inherited says which role it comes from.
Only permissions the viewer holds can be allowed, because Stalwart refuses
the rest, and a role carrying anything the viewer lacks opens read-only with
no delete, because Stalwart checks a grant but not a delete. Saving sends a
pointer for each permission and base role that changed.

The roles Stalwart hands out by default, read from x:Authentication, say so
before they are changed and cannot be deleted here; a role still in use is
kept by the server, and the refusal names what uses it.

The permission list is Stalwart's schema. A new route, GET
/api/admin/permissions, fetches /api/schema as the signed-in account and
returns only names and labels, behind the same two gates as the registry
methods and held in memory for an hour. Its labels are English only, so
every one of the 661 has a translation in each of the eight other
languages, in its own file keyed by permission name and loaded only when
Roles opens. A permission a later Stalwart adds shows its English label. A
test holds every language to the 0.16.22 snapshot: nothing missing, nothing
stale.

The mock answers x:Role/set with the grant check, loops and in-use
refusals, reads the defaults from x:Authentication, and serves the schema
gzipped as the real one is.

Fifty-two new strings and two plurals in all nine catalogues, and 661
permission labels with 59 headings in each of the eight translations.

web/src/locales/ja.ts

@@ -198,6 +198,58 @@ export const catalog: Catalog = {
     "Your organisation has reached the number of mailing lists it is allowed.": "組織で許可されているメーリングリスト数の上限に達しました。",
     "This mailing list no longer exists. Someone may have deleted it.": "このメーリングリストはもう存在しません。誰かが削除した可能性があります。",
     "The server did not say whether the list was created.": "リストが作成されたかどうか、サーバーから返答がありませんでした。",
+    "Roles": "ロール",
+    "users": "ユーザー",
+    "groups": "グループ",
+    "tenant administrators": "テナント管理者",
+    "administrators": "管理者",
+    "A role needs a name.": "ロールには名前が必要です。",
+    "Created {name}": "{name} を作成しました",
+    "New role": "新しいロール",
+    "This role carries permissions yours doesn't, so you can view it but not change it.": "このロールにはあなたのロールにない権限があるため、閲覧はできますが変更はできません。",
+    "Your role lets you view roles but not change them.": "あなたのロールでは、ロールの閲覧はできますが変更はできません。",
+    "Stalwart gives this role by default to {kinds}. A change here reaches everyone who has it that way.": "Stalwart はこのロールを既定で {kinds} に付与しています。ここでの変更は、その方法でこのロールを持つ全員に及びます。",
+    "Builds on": "継承元",
+    "Permissions": "権限",
+    "Stalwart gives this role by default, so it can't be deleted. Change the defaults in Stalwart's own administration first.": "Stalwart が既定で付与するロールのため、削除できません。先に Stalwart 自体の管理画面で既定値を変更してください。",
+    "This role carries permissions yours doesn't.": "このロールにはあなたのロールにない権限があります。",
+    "Create role": "ロールを作成",
+    "builds on this one": "このロールを継承しています",
+    "has permissions yours doesn't": "あなたのロールにない権限があります",
+    "No other roles": "ほかのロールはありません",
+    "A role has every permission of the roles it builds on, apart from any it or they deny.": "ロールは、継承元のロールのすべての権限を持ちます。ただし、このロールまたは継承元が拒否したものは除きます。",
+    "Search permissions": "権限を検索",
+    "All permissions": "すべての権限",
+    "Granted": "許可済み",
+    "Set on this role": "このロールで設定",
+    "No permissions match": "一致する権限はありません",
+    "{granted} of {total}": "{total} 件中 {granted} 件",
+    "Denied by {role}": "{role} により拒否",
+    "Granted by {role}": "{role} により許可",
+    "Inherit": "継承",
+    "Not set": "未設定",
+    "Allow": "許可",
+    "Deny": "拒否",
+    "A denial wins over anything allowed, here or on a role this one builds on. You can only allow permissions you hold yourself.": "拒否は、ここでも継承元のロールでも、あらゆる許可より優先されます。許可できるのは、あなた自身が持つ権限だけです。",
+    "Accounts, groups and other roles that use it must be moved off it first.": "このロールを使っているアカウント、グループ、ほかのロールから、先に外す必要があります。",
+    "Delete role…": "ロールを削除…",
+    "Deleted {name}": "{name} を削除しました",
+    "Still used by {things}. Move them to another role first.": "まだ {things} で使われています。先に別のロールを割り当ててください。",
+    "Delete role": "ロールを削除",
+    "It can't be undone.": "元に戻せません。",
+    "Type {name} to confirm": "確認のため {name} と入力してください",
+    "Stalwart's list of permissions could not be loaded, so permissions can't be changed here. ({reason})": "Stalwart の権限一覧を読み込めなかったため、ここでは権限を変更できません。（{reason}）",
+    "Named sets of permissions, given to accounts, groups and tenants.": "アカウント、グループ、テナントに付与する、名前付きの権限のまとまりです。",
+    "Search roles": "ロールを検索",
+    "No roles match": "一致するロールはありません",
+    "No roles yet": "まだロールがありません",
+    "Open {name}": "{name} を開く",
+    "Default for {kinds}": "既定の付与先: {kinds}",
+    "You can't give a role permissions your own role doesn't have.": "あなたのロールにない権限をロールに与えることはできません。",
+    "Your organisation has reached the number of roles it is allowed.": "組織で許可されているロール数の上限に達しました。",
+    "This role no longer exists. Someone may have deleted it.": "このロールはもう存在しません。誰かが削除した可能性があります。",
+    "the default roles": "既定のロール設定",
+    "The server did not say whether the role was created.": "ロールが作成されたかどうか、サーバーから返答がありませんでした。",
     "User": "ユーザー",
     "Administrator": "管理者",
     "Custom role": "カスタムロール",
@@ -1603,6 +1655,8 @@ export const catalog: Catalog = {
     "Its {n} members are taken out of the group first, and lose what was shared with it. The group's own mail is removed in the background, and it can't be undone.": { other: "まず {n} 人のメンバーがグループから外され、グループと共有されていたものを使えなくなります。グループのメールはバックグラウンドで削除され、元に戻せません。" },
     "{n} mailing lists": { other: "{n} 件のメーリングリスト" },
     "{n} recipients": { other: "{n} 件の受信者" },
+    "Grants {n} permissions": { other: "{n} 件の権限を付与" },
+    "{n} roles": { other: "{n} 件のロール" },
     "{n} DKIM keys": { other: "{n} 個の DKIM 鍵" },
     "{n} other items": { other: "その他 {n} 件" },
     // ── Administration ────────────────────────────────────────────────