Journaling: outside archives, and Journal it in mail flow rules

Phase 3 of the journaling spec.

- A journal's destination: builtIn (true for journals stored before) and
  archiveAddress, at least one. Reports to an archive are queued from the
  empty sender, one per address, flagged so they're never journaled.
- A pending record per report. When the queue lets go of one without
  delivering it (refused, expired, deleted), it becomes its own entry in
  the built-in journal under the sending journals' retention, the
  journal's archiveFailures (count, last time, reason) goes up, and the
  audit log records it; if that can't be written it stays queued.
- Journal it: a rule action naming a journal, on mail flow rules and
  beside a DLP rule's block, warn or hold. A journal whose scope chooses
  nobody takes only what rules send it.
- The report lists recipients a rule added or redirected to under
  "Added by rule", by rule name.
- A rule's route is cleared between messages in one SMTP session, with the
  new journal marks; a second message used to keep the first one's route.

tests/src/system/journal.rs: destination validation, a rule-only journal
fed by a rule that also adds a recipient, an unreachable archive's report
kept in the built-in journal with the failure counted, a report delivered
to an archive here and not journaled itself.

crates/features/src/journal/report.rs

@@ -20,6 +20,8 @@ use sha2::{Digest, Sha256};
 pub struct Recipient {
     pub address: String,
     pub orcpt: Option<String>,
+    /// The mail flow rule that added or redirected to it.
+    pub added_by: Option<String>,
 }
 
 /// What the queue knows about a message.
@@ -46,6 +48,8 @@ pub struct Fields {
     pub bcc: Vec<String>,
     /// A list's address, and its members among the recipients.
     pub expanded: Vec<(String, Vec<String>)>,
+    /// A rule's name, and the recipients it added.
+    pub added: Vec<(String, Vec<String>)>,
 }
 
 /// One line's worth of a value: no line breaks, no control characters.
@@ -106,7 +110,12 @@ pub fn fields(envelope: &Envelope<'_>, original: &[u8]) -> Fields {
             .as_deref()
             .map(orcpt_address)
             .filter(|via| !via.is_empty() && *via != address);
-        if header_to.contains(&address) {
+        if let Some(rule) = &rcpt.added_by {
+            match fields.added.iter_mut().find(|(name, _)| name == rule) {
+                Some((_, added)) => added.push(line(&rcpt.address)),
+                None => fields.added.push((line(rule), vec![line(&rcpt.address)])),
+            }
+        } else if header_to.contains(&address) {
             fields.to.push(line(&rcpt.address));
         } else if header_cc.contains(&address) {
             fields.cc.push(line(&rcpt.address));
@@ -159,6 +168,9 @@ pub fn text(envelope: &Envelope<'_>, fields: &Fields) -> String {
     for (list, members) in &fields.expanded {
         field("Expanded", &format!("{list} -> {}", members.join(", ")));
     }
+    for (rule, added) in &fields.added {
+        field("Added by rule", &format!("{rule} -> {}", added.join(", ")));
+    }
     if envelope.held {
         field("Held for review", "yes");
     }
@@ -265,6 +277,7 @@ The figures.\r\n";
         Recipient {
             address: address.into(),
             orcpt: orcpt.map(Into::into),
+            added_by: None,
         }
     }
 
@@ -337,6 +350,19 @@ The figures.\r\n";
         assert_eq!(original(&report), Some(unterminated));
     }
 
+    #[test]
+    fn rule_added_recipients_say_so() {
+        let mut copied = rcpt("[email protected]", None);
+        copied.added_by = Some("Copy finance".into());
+        let recipients = [rcpt("[email protected]", None), copied];
+        let env = envelope(&recipients);
+        let fields = fields(&env, ORIGINAL);
+        assert!(fields.bcc.is_empty(), "{fields:?}");
+        assert!(
+            text(&env, &fields).contains("Added by rule: Copy finance -> [email protected]\r\n")
+        );
+    }
+
     #[test]
     fn values_stay_on_one_line() {
         let recipients = [rcpt("[email protected]", None)];