Legal holds, step 1: the hold itself

inbuxa:LegalHold get/set places a hold on accounts, groups, domains,
tenants or the whole server, with an optional date range. A hold's range
and scope can only widen, a released hold is read-only, and none is ever
deleted. Placing, changing and releasing each need a reason and are
audited (LH-1, LH-3, LH-10, AU-12).

Permissions 669-672 (see, place, widen or release, export held data)
go to server administrators only; the tenant ceiling always strips them,
as it does Impersonate (LH-13). Schema: Compliance > Legal Holds.

What a hold keeps comes next, through the undelete hooks.

Also moves the lock expiry helpers below the lock module's imports.

crates/registry/src/schema/enums.rs

@@ -1739,6 +1739,11 @@ pub enum Permission {
     SysAccountLockCreate = 666,
     SysAccountLockUpdate = 667,
     SysAccountLockDestroy = 668,
+    // inbuxa: legal hold (audit-hold-lock spec, LH-13)
+    SysLegalHoldGet = 669,
+    SysLegalHoldCreate = 670,
+    SysLegalHoldUpdate = 671,
+    SysLegalHoldExport = 672,
     SysAccountGet = 219,
     SysAccountCreate = 220,
     SysAccountUpdate = 221,