Give IMAP, POP3 and ManageSieve a switch each

The legacy-protocols switch was all or nothing. An operator can now stop
POP3 and keep IMAP: each of IMAP, POP3 and ManageSieve has its own
switch, server-wide on inbuxa:ProtocolPolicy and per tenant on
inbuxa:TenantProtocolPolicy (properties imap, pop3, manageSieve).

legacyProtocols stays as the kill-all: setting it sets all three, and it
reads "disabled" exactly when all three are off. A policy stored before
this has only legacyProtocols and reads as all three at that value, so
existing servers and tenants carry over unchanged. In one /set, a
protocol named beside legacyProtocols overrides it.

SMTP submission keeps no switch of its own: sign-in over it is refused
only when all three are off, as the single switch did (LP-6), so
turning one protocol off never stops a mail app sending. For a tenant,
the server's switches and the tenant's count together.

Server-wide, a change closes the listeners of whatever is now off and
puts back the saved listeners of whatever is on again, both in one
change if asked; listeners of a protocol still off stay saved. Sign-in,
autoconfig, autodiscover, PACC (now prepared once per combination) and
the suggested DNS records all follow each protocol separately. A tenant
may turn a protocol on only while the server has it on (LP-9), and the
refusal names which. The JMAP session adds legacyAllowed, the protocols
still allowed for the account; legacyProtocols there keeps its meaning
for older webmail builds. Events name the switches ("pop3 disabled"),
and audit before/after reads every switch even from an older policy.

Tested: unit tests for the switches, the old-policy reading, the
server/tenant combination, the tenant refusal and listener refusal; and
tests/e2e/legacy_protocols.py against a running server, all 100 checks,
including new ones: POP3 alone off closes only its port and refuses
only its sign-in while IMAP and sending go on; only POP3 stops being
advertised; one change closes IMAP and reopens POP3; a tenant turns
POP3 off for itself, and can't turn IMAP on while the server has it off.

crates/jmap/src/api/session.rs

@@ -66,12 +66,16 @@ impl SessionHandler for Server {
             Capability::Inbuxa,
             Capabilities::Empty(EmptyCapabilities::default()),
         );
-        // inbuxa: legacy-protocols, Interfaces: whichever switch is stricter
-        let legacy_protocols = if self.legacy_protocols_off_for_account(access_token).await? {
+        // inbuxa: legacy-protocols, Interfaces: whichever switch is stricter,
+        // per protocol. `legacyProtocols` stays for older webmail builds:
+        // `disabled` only when every protocol is off.
+        let legacy_off = self.legacy_off_for_account(access_token).await?;
+        let legacy_protocols = if legacy_off.all() {
             "disabled"
         } else {
             "enabled"
         };
+        let legacy_allowed = legacy_off.allowed();
         // inbuxa: ai-explain, EX-1 to EX-4: whether Explain can be offered
         let ai_explain = access_token.has_permission(Permission::SysAiExplain)
             && access_token.tenant_id().is_none()
@@ -81,6 +85,7 @@ impl SessionHandler for Server {
             Capabilities::Inbuxa(InbuxaAccountCapabilities {
                 logo,
                 legacy_protocols,
+                legacy_allowed,
                 ai_explain,
             }),
         );