Lock accounts: keep receiving mail, no sign-in, hand to delegates

A locked account can't sign in (it fails as a wrong password does), its
sessions end on every node, refresh tokens stop working, and its Sieve
scripts forward and reply to nothing. Mail keeps arriving.

Delegates get real ACL grants on the account's mailboxes, calendars,
address books and files at read, organize or full, with the rights they
replaced restored on unlock. Folders made later are granted after the
create and in a daily sweep. Organize delegates can't destroy; send-as
needs organize or full. The JMAP session marks delegated accounts in
urn:inbuxa:jmap.

New inbuxa:AccountLock object with get/set, permissions 665-668, and a
Compliance > Locked Accounts entry in the schema. Lock, unlock and
delegate changes need a reason and are audited; delegate access and
writes are audited too (audit-hold-lock spec AL-1 to AL-12).

crates/jmap/src/email/set.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::{
@@ -1141,7 +1143,20 @@ impl EmailSet for Server {
         }
 
         // Process deletions
-        if !will_destroy.is_empty() {
+        // inbuxa: AL-6: a delegate below full may move mail, never delete it
+        if !will_destroy.is_empty()
+            && access_token
+                .delegation(account_id)
+                .is_some_and(|delegation| !delegation.access.may_destroy())
+        {
+            for destroy_id in will_destroy {
+                response.not_destroyed.append(
+                    destroy_id,
+                    SetError::forbidden()
+                        .with_description("A delegate at this level can move mail but not delete it."),
+                );
+            }
+        } else if !will_destroy.is_empty() {
             let email_ids = cache.email_document_ids();
             let can_destroy_message_ids = if access_token.is_shared(account_id) {
                 cache.shared_messages(access_token, Acl::RemoveItems).into()