Lock accounts: keep receiving mail, no sign-in, hand to delegates

A locked account can't sign in (it fails as a wrong password does), its
sessions end on every node, refresh tokens stop working, and its Sieve
scripts forward and reply to nothing. Mail keeps arriving.

Delegates get real ACL grants on the account's mailboxes, calendars,
address books and files at read, organize or full, with the rights they
replaced restored on unlock. Folders made later are granted after the
create and in a daily sweep. Organize delegates can't destroy; send-as
needs organize or full. The JMAP session marks delegated accounts in
urn:inbuxa:jmap.

New inbuxa:AccountLock object with get/set, permissions 665-668, and a
Compliance > Locked Accounts entry in the schema. Lock, unlock and
delegate changes need a reason and are audited; delegate access and
writes are audited too (audit-hold-lock spec AL-1 to AL-12).

crates/jmap-proto/src/request/capability.rs

@@ -133,9 +133,31 @@ pub enum Capabilities {
     FileNode(FileNodeCapabilities),
     WebPush(WebPushCapabilities),
     Inbuxa(InbuxaAccountCapabilities),
+    // inbuxa: AL-7
+    InbuxaDelegated(InbuxaDelegatedCapabilities),
     Empty(EmptyCapabilities),
 }
 
+/// inbuxa: `urn:inbuxa:jmap` on a locked account delegated to the signed-in
+/// principal (audit-hold-lock spec, AL-7), so a client can tell it from an
+/// ordinary share without guessing from `isReadOnly`.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct InbuxaDelegatedCapabilities {
+    pub delegation: DelegationInfo,
+}
+
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct DelegationInfo {
+    /// Always true: only locked accounts are delegated.
+    pub locked: bool,
+    /// `read`, `organize` or `full`.
+    pub access: &'static str,
+    #[serde(rename(serialize = "sendAs"))]
+    pub send_as: bool,
+    /// When the delegation ends, if it does (UTC).
+    pub until: Option<String>,
+}
+
 /// inbuxa: `urn:inbuxa:jmap` on the signed-in principal's own account.
 #[derive(Debug, Clone, serde::Serialize)]
 pub struct InbuxaAccountCapabilities {