Multi-tenancy: the inbuxa-features crate, the permission ceiling and tenant disk quota (MT-12, MT-13, MT-14, MT-15, MT-16, MT-19, MT-20)

New crate crates/features (inbuxa-features), AGPL-3.0-only, holding the
tenancy rules. Hooks in common: a tenant's roles and permission lists cap
its people's permissions; a change to a tenant, or to a role a tenant holds,
drops its members' cached permissions; delivery and every other write check
the tenant's maxDiskQuota; usedDiskQuota reads the tenant usage counter.
The default Tenant Administrator role gains sysTenantGet and sysTenantQuery.

crates/features/src/lib.rs

@@ -0,0 +1,21 @@
+/*
+ * SPDX-FileCopyrightText: 2026 John Coffey
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! INBUXA's rebuilt features.
+//!
+//! Upstream ships these only in its Enterprise Edition. INBUXA rebuilds each
+//! one clean-room from a written spec under `docs/spec/features/`, one module
+//! per feature, and ships it to everybody (docs/spec/SPEC.md §2.3, §3).
+//!
+//! Upstream files change only by small hooks that call in here, each marked
+//! with an `inbuxa:` comment naming the requirement it serves. That keeps
+//! every upstream merge's conflicts few and predictable.
+//!
+//! This crate sits below `common`, so hooks anywhere in the server can call
+//! it. It works on registry objects and the store directly, never on
+//! `common::Server`.
+
+pub mod tenancy;