Journaling: outside archives, and Journal it in mail flow rules

Phase 3 of the journaling spec.

- A journal's destination: builtIn (true for journals stored before) and
  archiveAddress, at least one. Reports to an archive are queued from the
  empty sender, one per address, flagged so they're never journaled.
- A pending record per report. When the queue lets go of one without
  delivering it (refused, expired, deleted), it becomes its own entry in
  the built-in journal under the sending journals' retention, the
  journal's archiveFailures (count, last time, reason) goes up, and the
  audit log records it; if that can't be written it stays queued.
- Journal it: a rule action naming a journal, on mail flow rules and
  beside a DLP rule's block, warn or hold. A journal whose scope chooses
  nobody takes only what rules send it.
- The report lists recipients a rule added or redirected to under
  "Added by rule", by rule name.
- A rule's route is cleared between messages in one SMTP session, with the
  new journal marks; a second message used to keep the first one's route.

tests/src/system/journal.rs: destination validation, a rule-only journal
fed by a rule that also adds a recipient, an unreachable archive's report
kept in the built-in journal with the failure counted, a report delivered
to an archive here and not journaled itself.

crates/smtp/src/inbound/mailflow.rs

@@ -63,9 +63,12 @@ pub struct HeldDraft {
 
 /// What a transport rule changes about where a message goes.
 pub enum EnvelopeChange {
-    AddRecipient(String),
-    Redirect(Vec<String>),
+    /// An address, and the rule that added it.
+    AddRecipient(String, String),
+    Redirect(Vec<String>, String),
     Route(String),
+    /// Journaling spec, JR-10: a journal the message goes to.
+    Journal(u32),
 }
 
 /// `[override: reason]` at the start of a subject: the reason, and the
@@ -402,11 +405,17 @@ impl<T: SessionStream> Session<T> {
                                 rewrite::prefix_subject(now, text)
                             }
                             RuleAction::AddRecipient { address } => {
-                                changes.push(EnvelopeChange::AddRecipient(address.clone()));
+                                changes.push(EnvelopeChange::AddRecipient(
+                                    address.clone(),
+                                    matched.name.clone(),
+                                ));
                                 None
                             }
                             RuleAction::Redirect { addresses } => {
-                                changes.push(EnvelopeChange::Redirect(addresses.clone()));
+                                changes.push(EnvelopeChange::Redirect(
+                                    addresses.clone(),
+                                    matched.name.clone(),
+                                ));
                                 None
                             }
                             RuleAction::Route { queue } => {
@@ -423,7 +432,8 @@ impl<T: SessionStream> Session<T> {
                             }
                             RuleAction::Block { .. }
                             | RuleAction::Warn { .. }
-                            | RuleAction::Hold { .. } => None,
+                            | RuleAction::Hold { .. }
+                            | RuleAction::Journal { .. } => None,
                         };
                         if next.is_some() {
                             current = next;
@@ -450,6 +460,19 @@ impl<T: SessionStream> Session<T> {
                             .await;
                     }
                 }
+                // JR-10: journals any matched rule sends the message to,
+                // DLP rules included
+                for matched in &outcome.matched {
+                    for action in &matched.actions {
+                        if let RuleAction::Journal { journal } = action
+                            && !changes
+                                .iter()
+                                .any(|c| matches!(c, EnvelopeChange::Journal(j) if j == journal))
+                        {
+                            changes.push(EnvelopeChange::Journal(*journal));
+                        }
+                    }
+                }
                 match hold {
                     Some(draft) => Checked::Hold {
                         draft,