Legal holds, step 1: the hold itself

inbuxa:LegalHold get/set places a hold on accounts, groups, domains,
tenants or the whole server, with an optional date range. A hold's range
and scope can only widen, a released hold is read-only, and none is ever
deleted. Placing, changing and releasing each need a reason and are
audited (LH-1, LH-3, LH-10, AU-12).

Permissions 669-672 (see, place, widen or release, export held data)
go to server administrators only; the tenant ceiling always strips them,
as it does Impersonate (LH-13). Schema: Compliance > Legal Holds.

What a hold keeps comes next, through the undelete hooks.

Also moves the lock expiry helpers below the lock module's imports.

crates/common/src/auth/permissions.rs

@@ -104,6 +104,16 @@ impl Server {
         ceiling(base, policy).apply(&mut permissions.enabled, &mut permissions.disabled);
         // inbuxa: MT-1, MT-15: impersonation would reach beyond the tenant
         permissions.disabled.set(Permission::Impersonate as usize);
+        // inbuxa: LH-13: only server-level administrators see or place
+        // holds, and a hold may concern the tenant's own administrator
+        for permission in [
+            Permission::SysLegalHoldGet,
+            Permission::SysLegalHoldCreate,
+            Permission::SysLegalHoldUpdate,
+            Permission::SysLegalHoldExport,
+        ] {
+            permissions.disabled.set(permission as usize);
+        }
 
         Ok(())
     }
@@ -254,6 +264,11 @@ impl Default for DefaultPermissions {
                     default.tenant.push(permission);
                 }
                 Permission::Impersonate
+                // inbuxa: LH-13: holds are the server administrator's alone
+                | Permission::SysLegalHoldGet
+                | Permission::SysLegalHoldCreate
+                | Permission::SysLegalHoldUpdate
+                | Permission::SysLegalHoldExport
                 | Permission::UnlimitedRequests
                 | Permission::UnlimitedUploads
                 | Permission::LiveMetrics