Manage public keys, over Stalwart's x:PublicKey registry

A new Settings section, next to Identities & signatures: list, add,
rename and remove the OpenPGP public keys and S/MIME certificates
published on this account. Only public material -- no private key is
stored, requested or sent by any of this.

This is PR #67 revived. That branch was built against 0.16.19, closed
unmerged on 2026-08-26, and shares no ancestry with main after the email
scrub, so it is ported rather than rebased: the four files it added are
carried over, the three it edited are applied by hand, and everything it
claimed was re-probed against the live 0.16.20 on 2026-09-05. The i18n
work is new -- nine catalogues landed on 2026-08-31, after that branch
was written.

What the re-probe confirmed, unchanged from 0.16.19:

  - An ordinary user may read *and* write their own keys, though the
    permissions table lists every sysPublicKey* permission as
    administrative. get and query both answered for a normal account,
    and a malformed create came back invalidProperties naming `key`
    rather than forbidden -- a rejection of the key, not of the person.

  - The server parses the key and says precisely what is wrong. So
    ihasmail does not validate key material; the server's message is
    shown verbatim, as password-policy rejections already are.

  - urn:stalwart:jmap is still absent from the session's top-level
    capabilities and present per-account, so the check that reads all
    three places is still the one that works.

What it added, none of which was known before:

  - A key can parse perfectly and still be refused, with different
    words: a sign-and-certify key with no encryption subkey -- what
    `gpg --quick-generate-key` produces -- gets "Could not find any
    suitable keys in OpenPGP public key". That is the rejection somebody
    exporting from GnuPG will actually meet, and it is not a paste
    error, so collapsing both to "invalid key" would send them back to
    the clipboard for a problem that is in the key.

  - emailAddresses comes back as {} when empty -- an object where a JMAP
    list property should be an array. It type-checks, then throws in
    join() while the list renders. normalize() checked the shape
    already; there is now a test saying why, and the mock answers {} the
    same way, because one that helpfully returned [] would let that
    crash ship.

  - A create answers with the id alone, no createdAt, so adding a key
    reloads rather than believing the response.

  - destroy works and leaves the registry empty. PR #67 shipped that
    path untested -- its live probe was refused before anything was
    created, so there was nothing to destroy.

  - Patching `key` is allowed by the server. The mock still refuses it,
    now deliberately rather than for want of evidence: ihasmail replaces
    a key by adding one and removing the old, which keeps createdAt
    meaning what it says.

x:EncryptionAtRest still does not exist on 0.16.20 -- asking for it is
an unknownMethod. encryptionAtRest is a field on x:AccountSettings, and
its value is a typed object ({"@type":"Disabled"}) rather than the bare
string ROADMAP described. Nothing here writes it.

An empty description is now sent as empty rather than filled in with
"Key". The description is stored on the server, so a default invented in
the client would be whichever language the adder happened to be using;
the list labels a blank one at render time instead.

Verified in a browser against the mock, not only in tests: both
rejections reach the toast in the server's own words with the form still
filled in, a good key renders its card, the kind is labelled from the
armour header, renaming persists, removing asks first and empties the
list, and the whole section reads correctly in German.

web/src/locales/uk.ts

@@ -1300,6 +1300,36 @@ export const catalog: Catalog = {
     "Empty “{name}”?": "Очистити «{name}»?",
     "Delete them": "Видалити їх",
     "Nothing was deleted": "Нічого не видалено",
+    // ── Encryption keys, over Stalwart's x:PublicKey registry (#67) ──
+    "Encryption keys": "Ключі шифрування",
+    "Not available on this server": "Недоступно на цьому сервері",
+    "Public keys are kept in Stalwart's registry, which this server does not offer. ihasmail needs Stalwart 0.16 or newer for it.": "Відкриті ключі зберігаються в реєстрі Stalwart, якого цей сервер не надає. Для цього ihasmail потребує Stalwart 0.16 або новішої версії.",
+    "Public keys for this account — what other people encrypt to, and what a signature is checked against. These are public by nature: no private key is stored, requested, or sent by ihasmail.": "Відкриті ключі цього облікового запису — те, чим інші шифрують листи для вас, і те, за чим перевіряється підпис. Вони відкриті за своєю природою: ihasmail не зберігає, не запитує і не надсилає закритих ключів.",
+    "No keys yet": "Ключів ще немає",
+    "Add an OpenPGP public key or an S/MIME certificate to publish it on this account.": "Додайте відкритий ключ OpenPGP або сертифікат S/MIME, щоб опублікувати його в цьому обліковому записі.",
+    "Key added": "Ключ додано",
+    "Key removed": "Ключ прибрано",
+    "Remove “{name}”?": "Прибрати «{name}»?",
+    "this key": "цей ключ",
+    "Anyone holding it can still use it — removing it here only stops this account offering it.": "У того, хто вже його має, він залишиться — тут це лише припиняє пропонувати його від цього облікового запису.",
+    "Remove key": "Прибрати ключ",
+    "Key description": "Опис ключа",
+    "Untitled key": "Ключ без назви",
+    "Click to rename": "Натисніть, щоб перейменувати",
+    "Expired": "Закінчився",
+    "Added": "Додано",
+    "Addresses": "Адреси",
+    "No expiry set": "Термін дії не задано",
+    "Any address on this account": "Будь-яка адреса цього облікового запису",
+    "cryptography\u0004Key": "Ключ",
+    "Public key": "Відкритий ключ",
+    "Work key": "Робочий ключ",
+    "Paste the whole armoured block, headers included. The server checks it and says what is wrong if it cannot read it.": "Вставте весь блок цілком, разом із заголовками. Сервер перевірить його і скаже, що не так, якщо не зможе прочитати.",
+    "Add key": "Додати ключ",
+    "Add a key": "Додати ключ",
+    "Stalwart stores these keys, and this release does no more than manage them: ihasmail does not yet sign, encrypt, decrypt or verify anything with them. Adding one does not by itself start encrypting your mail.": "Stalwart зберігає ці ключі, а ця версія лише керує ними: ihasmail поки нічого ними не підписує, не шифрує, не розшифровує і не перевіряє. Додавання ключа саме собою не починає шифрувати вашу пошту.",
+    "Unrecognised": "Не розпізнано",
+    "No account to add a key to.": "Немає облікового запису, до якого можна додати ключ.",
   },
   plurals: {
     // ── Third pass ─────────────────────────────────────────────────────