Import upstream v0.16.22, stripped

Upstream commit: 474dd0229cb20cf513036619781ed97bd8073c3f
Enterprise-only files removed or emptied: 63
Enterprise-only snippets removed: 117 in 50 files
Dangling module declarations removed: 5
Cargo edits turning enterprise off: 14
Verification: clean
Enterprise feature gates left for rebuilt features: 19 in 18 files

Produced by tools/fork/strip.py. The full report is in docs/fork/strip-reports/ on main.

tests/docker/scripts/gen-certs.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+set -e
+
+CERT_DIR=/certs
+
+if [ ! -f "$CERT_DIR/cert.pem" ]; then
+  echo "Generating self-signed certificate..."
+  openssl req -x509 -newkey rsa:2048 -nodes \
+    -keyout "$CERT_DIR/key.pem" \
+    -out "$CERT_DIR/cert.pem" \
+    -days 365 \
+    -subj "/CN=localhost/O=Stalwart Test/C=US" \
+    -addext "subjectAltName=DNS:localhost,DNS:keycloak,DNS:openldap,DNS:pebble,DNS:*.stalwart.test,IP:127.0.0.1"
+  
+  # Create combined PEM for services that need it
+  cat "$CERT_DIR/cert.pem" "$CERT_DIR/key.pem" > "$CERT_DIR/combined.pem"
+  
+  # Create PKCS12 for Keycloak
+  openssl pkcs12 -export -in "$CERT_DIR/cert.pem" -inkey "$CERT_DIR/key.pem" \
+    -out "$CERT_DIR/keystore.p12" -name localhost -password pass:changeit
+  
+  chmod 644 "$CERT_DIR"/*
+  echo "Certificates generated."
+else
+  echo "Certificates already exist."
+fi