Import upstream v0.16.25, stripped

Upstream commit: 3f657330c0f49a015a3a372fb59669b5cccbca6d
Enterprise-only files removed or emptied: 63
Enterprise-only snippets removed: 118 in 50 files
Dangling module declarations removed: 5
Edits turning enterprise off: 25
Third-party code: 14 files, 0 not in THIRD-PARTY.md
Renamed identifiers: 67 in 19 files
Verification: clean

The same Enterprise footprint as v0.16.24. The build check is clean
apart from the expected errors in the rebuilt-feature tests. A
bug-fix release: DKIM rotation, IMAP failed-login answers, DNSBL
multi-code scoring and negative TTLs, Pyzor on short messages, queue
quotas with an empty match, RocksDB info-log rotation, and
Autodiscover schema handling.

crates/imap-proto/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "imap_proto"
-version = "0.16.24"
+version = "0.16.25"
 edition = "2024"
 
 [dependencies]

crates/imap-proto/src/protocol/mod.rs

@@ -677,7 +677,13 @@ pub trait SerializeResponse {
 impl SerializeResponse for trc::Error {
     fn serialize(&self) -> Vec<u8> {
         let mut buf = Vec::with_capacity(128);
-        if let Some(tag) = self.value_as_str(trc::Key::Id) {
+        if let Some(tag) = self
+            .keys()
+            .iter()
+            .rev()
+            .find_map(|(key, value)| (*key == trc::Key::Id).then_some(value))
+            .and_then(|value| value.as_str())
+        {
             buf.extend_from_slice(tag.as_bytes());
         } else {
             buf.push(b'*');
@@ -813,9 +819,51 @@ impl Display for Command {
 #[cfg(test)]
 mod tests {
     use crate::parser::parse_sequence_set;
-    use crate::protocol::ObjectId;
+    use crate::protocol::{ObjectId, SerializeResponse};
     use types::id::Id;
 
+    #[test]
+    fn serialize_error_uses_command_tag() {
+        for (error, expected) in [
+            (
+                trc::AuthEvent::Failed.into_err().id("a1"),
+                "a1 NO [AUTHENTICATIONFAILED] ",
+            ),
+            (
+                trc::AuthEvent::Failed
+                    .into_err()
+                    .ctx(trc::Key::Id, 7u32)
+                    .id("a1"),
+                "a1 NO [AUTHENTICATIONFAILED] ",
+            ),
+            (
+                trc::AuthEvent::Error
+                    .into_err()
+                    .ctx(trc::Key::Id, "12")
+                    .id("a2"),
+                "a2 NO [AUTHENTICATIONFAILED] ",
+            ),
+            (
+                trc::AuthEvent::TooManyAttempts
+                    .into_err()
+                    .caused_by(trc::AuthEvent::Failed.into_err().ctx(trc::Key::Id, 7u32))
+                    .id("a3"),
+                "a3 NO [AUTHENTICATIONFAILED] ",
+            ),
+            (
+                trc::AuthEvent::Failed.into_err().ctx(trc::Key::Id, 7u32),
+                "* NO [AUTHENTICATIONFAILED] ",
+            ),
+        ] {
+            let response = error.serialize();
+            assert!(
+                response.starts_with(expected.as_bytes()),
+                "{:?} does not start with {expected:?}",
+                String::from_utf8_lossy(&response)
+            );
+        }
+    }
+
     #[test]
     fn serialize_objectid_compound() {
         // Empty compound