Fork Stalwart WebUI v1.0.11 as INBUXA Admin

- One edition: whatever edition the server reports, nothing is hidden or
  disabled as Enterprise-only (accountStore.setAccountInfo).
- INBUXA branding: name, logo (mark plus a text-colored wordmark), favicon,
  page titles, setup wizard text, and ihasmail's palette in light and dark.
- Two-factor setup names INBUXA as the issuer and drops the image parameter
  that made authenticator apps fetch a logo from a third-party site.
- Runs apart from the server: the server address can be set at deploy time
  with <meta name="api-base-url">, and OAuth endpoints the server returns as
  relative paths are resolved against the server's address, not the page's.
  Verified end to end against a separate inbuxa-server.
- Upstream's release workflow moved to .github-upstream so it never runs.

Upstream's history contains no Enterprise-only code, so this is an ordinary
fork. upstream is a fetch-only remote.

src/services/auth/oauth.ts

@@ -32,7 +32,19 @@ export async function discover(username: string): Promise<DiscoveryResponse> {
       }),
     );
   }
-  return response.json() as Promise<DiscoveryResponse>;
+  const discovered = (await response.json()) as DiscoveryResponse;
+  // A server that doesn't know its public URL yet (bootstrap mode, or no
+  // public URL configured) returns relative endpoints such as "/login". They
+  // belong to the server, so resolve them against the server's address, not
+  // this page's: INBUXA Admin is usually served from somewhere else.
+  const base = `${getApiBaseUrl()}/`;
+  const absolute = (endpoint: string | undefined) => (endpoint ? new URL(endpoint, base).toString() : endpoint);
+  return {
+    ...discovered,
+    authorization_endpoint: absolute(discovered.authorization_endpoint) as string,
+    token_endpoint: absolute(discovered.token_endpoint) as string,
+    end_session_endpoint: absolute(discovered.end_session_endpoint),
+  };
 }
 
 const UNRESERVED = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';