Journaling: capture at the queue, the built-in journal, retention

Phase 2 of the journaling spec.

- A copy of each message is taken in MessageWrapper::queue, after DLP and
  transport rules, for every enabled journal that takes it (direction and
  scope: everyone, or accounts, groups, domains, tenants). If the copy
  can't be taken the message isn't queued (temporary failure).
- The journal report: the envelope one field a line (sender, To, Cc, Bcc
  from the envelope, list members from their ORCPT, direction, held for
  review), then the queued message byte for byte as message/rfc822.
- The built-in journal under J in the inbuxa subspace: one chain per node
  whose links name each entry by SHA-256, so entries can expire out of
  chain order; purge leaves a marker, and verify catches an entry changed
  or removed early and a report that doesn't match.
- Retention per journal (30 to 3650 days); an entry keeps what it was
  written with. The daily maintenance purges what's due, keeping entries
  whose people a legal hold covers (deleted accounts a hold keeps too),
  and records the counts in the audit log.
- inbuxa:Journal get/set, audited by the request layer. Permissions
  680-683: administrators see and change journals; the Compliance Officer
  sees, searches and exports. Whoever changes journals may grant search and
  export without holding them, so officers can still be appointed.
- Catalog entries (inbuxa:Journal, source "journal"); spec as-built notes.

tests/src/system/journal.rs: validation, internal mail with a Bcc,
outgoing into two journals, incoming over LMTP, the report and its
original, tamper and early removal caught, hold-aware purge, retention
changes leave entries alone, disabled and removed journals take nothing.

resources/privacy/catalog.toml

@@ -113,6 +113,18 @@ exceptions = ["contact", "content"]
 actions = ["contact", "content"]
 createdBy = ["identifier"]
 
+[object."inbuxa:Journal"]
+file = "inbuxa_journal.rs"
+default = "none"
+whose = ["administrator"]
+where = ["data-store"]
+scope = "server"
+retention = "unbounded"
+[object."inbuxa:Journal".properties]
+name = ["content"]
+description = ["content"]
+createdBy = ["identifier"]
+
 [object."inbuxa:LegalHold"]
 file = "inbuxa_legal_hold.rs"
 default = "none"
@@ -408,6 +420,19 @@ captures = ["x:Email.maxMaskedAddresses"]
 leaves_host = false
 written_by = ["crates/features/src/masked_email/data.rs"]
 
+# Journaling (journaling spec, JR-5, JR-14): a copy of each message a
+# journal takes, with its envelope, kept for the journal's retention even
+# after the account is deleted, and longer while a legal hold covers
+# someone on it.
+[source."journal"]
+categories = ["content", "identifier", "contact", "metadata"]
+whose = ["holder", "correspondent"]
+where = ["data-store", "blob-store"]
+scope = "server"
+retention = { setting = "inbuxa:Journal.retentionDays" }
+leaves_host = false
+written_by = ["crates/features/src/journal/entries.rs", "crates/smtp/src/queue/journal.rs"]
+
 [source."outbound-reports"]
 categories = ["network", "identifier", "content"]
 whose = ["correspondent"]