Merge upstream v0.16.24

Eight conflicted files resolved, plus the lock file and the schema:

- crates/services/src/task_manager/spam_classifier.rs: upstream's rules
  update now replaces existing rules, DNSBL servers, lookups and file
  extensions, keeping only whether each is on. Taken, with one difference:
  an object an admin edited is kept as it is. Every object an update writes
  is fingerprinted (content without `enable`, SHA-256, stored under
  SUBSPACE_INBUXA "Sf"), and only one that still matches is replaced.
  Scores are never replaced, as upstream has it. The AU-1.10 summary record
  now names what was added, replaced and kept, and the bundled rules are
  marked applied only when the update fully succeeded, so a failure runs
  again on the next start. The marker becomes "3.0.2+2", which runs the
  update once on upgrade to fingerprint every rule still as bundled.
- crates/common/src/network/autoconfig/autodiscover.rs: upstream's rewrite
  (implicit TLS first, labeled SSL), with the per-protocol switches (LP-7,
  LP-14a) passed in as a filter.
- crates/store/src/backend/mysql/{search,write}.rs: upstream's chunked
  deletes (no unbounded first DELETE, stop on a short chunk, halve the
  chunk on the new chunk-too-large errors) inside the fork's query timeout.
- crates/smtp/src/lib.rs: the fork's queue spawn kept. It already fixed the
  stall upstream fixes here (a node without outboundMta stops accepting
  mail at about 1024 queued messages), and follows role changes live.
- crates/jmap/src/registry/mapping/bootstrap.rs: the log path stays
  /var/log/inbuxa/; upstream's PowerDNS mapping taken.
- crates/main/Cargo.toml: the AGPL-only license kept, version 0.16.24.
- tests/src/jmap/principal/get.rs: the fork's capabilities kept.
- resources/schema/schema.json.gz: merged as JSON; upstream relabeled the
  vendor Sieve extensions "(Stalwart)", kept as "(vnd.inbuxa)".
- Cargo.lock: upstream's, with the fork's crates added by Cargo.

Also:

- tests/src/smtp/inbound/spam_rules_kept.rs: an edited rule survives an
  update, an unedited one is updated, rules from before fingerprints are
  handled, and the audit summary says so. Upstream's own spam_rules test
  passes unchanged.
- tests/src/smtp/reporting/reschedule.rs moves to port 19058; upstream's
  new spam_rules test took 19057.
- tools/fork/renames.py renames the "(Stalwart)" labels and the default
  log path, so neither conflicts again.
- tools/fork/notice-check.py compares against the newest snapshot in the
  checked-out history instead of the upstream branch head, so moving the
  branch no longer fails other open pull requests.
- tests/src/directory/issuer.rs (since v0.16.23) stays out, and is on the
  build check's known list: it tests issuer-based directory routing, which
  the fork doesn't have (DIR-2).
- Strip report: docs/fork/strip-reports/v0.16.24.{md,json}.

crates/spam-filter/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "spam-filter"
-version = "0.16.23"
+version = "0.16.24"
 edition = "2024"
 
 [dependencies]

crates/spam-filter/src/analysis/url.rs

@@ -203,7 +203,7 @@ impl SpamFilterAnalyzeUrl for Server {
 
                     if !ctx.result.has_tag("URL_REDIRECTOR_NESTED") {
                         let mut redirect_count = 1;
-                        let mut url_redirect = Cow::Borrowed(url.element.url.as_str());
+                        let mut url_redirect = url.element.request_url();
 
                         while redirect_count <= 3 {
                             match http_get_header(
@@ -224,7 +224,8 @@ impl SpamFilterAnalyzeUrl for Server {
                                         )
                                         .await
                                         {
-                                            url_redirect = Cow::Owned(location.url);
+                                            url_redirect =
+                                                Cow::Owned(location.request_url().into_owned());
                                             redirect_count += 1;
                                             continue;
                                         } else {
@@ -487,6 +488,15 @@ impl<'x> UrlParts<'x> {
                 .is_some_and(|url| url.host.fqdn.starts_with("www."))
     }
 
+    pub fn request_url(&self) -> Cow<'_, str> {
+        let url = self.url_original.trim();
+        if self.has_scheme {
+            Cow::Borrowed(url)
+        } else {
+            Cow::Owned([HTTPS_SCHEME, url].concat())
+        }
+    }
+
     fn parse(url: &str) -> Option<UrlParsed> {
         url.parse::<Uri>().ok().and_then(|parts| {
             parts
@@ -505,3 +515,19 @@ impl<'x> UrlParts<'x> {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn request_url_keeps_case() {
+        let url = UrlParts::new(" https://Bit.ly/3AbCdEf ");
+        assert_eq!(url.url, "https://bit.ly/3abcdef");
+        assert_eq!(url.request_url(), "https://Bit.ly/3AbCdEf");
+
+        let url = UrlParts::no_scheme("Bit.ly/3AbCdEf");
+        assert_eq!(url.url, "https://bit.ly/3abcdef");
+        assert_eq!(url.request_url(), "https://Bit.ly/3AbCdEf");
+    }
+}

crates/spam-filter/src/modules/classifier.rs

@@ -259,9 +259,7 @@ impl SpamClassifier for Server {
                         remove_entries = true;
                     }
 
-                    if trainer.last_id == 0 {
-                        trainer.last_id = id;
-                    }
+                    trainer.last_id = trainer.last_id.max(id);
 
                     Ok(true)
                 },