Let an operator turn administration off

ADMINISTRATION=0 at launch removes in-app administration for everyone. The
account's permissions are no longer sent to the browser, so the menu never
appears, and the JMAP proxy refuses Stalwart registry methods other than the
account's own (settings, password, app passwords, API keys, public keys,
masked addresses). Hiding the menu alone would have left an administrator's
browser console able to make every call the menu made.

With administration on, the request body streams through untouched as before;
only an installation that turns it off reads and checks the body, forwarding
the parsed form so the server receives exactly what was inspected.

.env.example

@@ -61,6 +61,12 @@ MAX_UPLOAD_BYTES=52428800
 # Remote-image privacy proxy (Gmail-style). Set to 0 to load remote images directly.
 IMAGE_PROXY=1
 
+# In-app administration, for accounts whose Stalwart role manages accounts and
+# domains. 0 turns it off for everyone: no menu, and the JMAP proxy refuses
+# Stalwart's registry methods beyond an account's own password, app passwords
+# and settings. Stalwart's own admin interface is not affected.
+ADMINISTRATION=1
+
 # Branding
 APP_NAME=ihasmail