Masked email: rewrite to the owner at RCPT TO, create responses carry the address, admins query all masks (ME-4, ME-9, ME-13, ME-19)

Found by running system_tests, which masked email no longer stops:
- rcpt_resolve rewrites a live mask to its owner's address, so
  Delivered-To names the account; delivery recognizes the mask from the
  original recipient when it belongs to that account.
- x:MaskedEmail/set create responses carry the server-set email.
- x:MaskedEmail/query returns every mask to a server-level impersonate
  holder, and filters on accountId.
- The refusal for an unlinked emailDomain uses upstream's wording.
- The shared delivery test checks the fork's address format (ME-13).
- The masked email test's tenant domain uses manual DKIM, so its cleanup
  leaves nothing behind.

tests/src/system/delivery.rs

@@ -216,8 +216,11 @@ pub async fn test(test: &mut TestServer) {
     let masked = response.created(0);
     let masked_random_id = masked.object_id();
     let masked_random_email = masked.text_field("email").to_string();
+    // inbuxa: ME-13: the fork's addresses never contain a '.' in the local
+    // part, so they can't be mistaken for upstream's
     assert!(
-        masked_random_email.contains(".") && masked_random_email.ends_with("@example.org"),
+        !masked_random_email.split('@').next().unwrap().contains('.')
+            && masked_random_email.ends_with("@example.org"),
         "Unexpected masked email: {masked_random_email}"
     );