Merge upstream v0.16.24

Eight conflicted files resolved, plus the lock file and the schema:

- crates/services/src/task_manager/spam_classifier.rs: upstream's rules
  update now replaces existing rules, DNSBL servers, lookups and file
  extensions, keeping only whether each is on. Taken, with one difference:
  an object an admin edited is kept as it is. Every object an update writes
  is fingerprinted (content without `enable`, SHA-256, stored under
  SUBSPACE_INBUXA "Sf"), and only one that still matches is replaced.
  Scores are never replaced, as upstream has it. The AU-1.10 summary record
  now names what was added, replaced and kept, and the bundled rules are
  marked applied only when the update fully succeeded, so a failure runs
  again on the next start. The marker becomes "3.0.2+2", which runs the
  update once on upgrade to fingerprint every rule still as bundled.
- crates/common/src/network/autoconfig/autodiscover.rs: upstream's rewrite
  (implicit TLS first, labeled SSL), with the per-protocol switches (LP-7,
  LP-14a) passed in as a filter.
- crates/store/src/backend/mysql/{search,write}.rs: upstream's chunked
  deletes (no unbounded first DELETE, stop on a short chunk, halve the
  chunk on the new chunk-too-large errors) inside the fork's query timeout.
- crates/smtp/src/lib.rs: the fork's queue spawn kept. It already fixed the
  stall upstream fixes here (a node without outboundMta stops accepting
  mail at about 1024 queued messages), and follows role changes live.
- crates/jmap/src/registry/mapping/bootstrap.rs: the log path stays
  /var/log/inbuxa/; upstream's PowerDNS mapping taken.
- crates/main/Cargo.toml: the AGPL-only license kept, version 0.16.24.
- tests/src/jmap/principal/get.rs: the fork's capabilities kept.
- resources/schema/schema.json.gz: merged as JSON; upstream relabeled the
  vendor Sieve extensions "(Stalwart)", kept as "(vnd.inbuxa)".
- Cargo.lock: upstream's, with the fork's crates added by Cargo.

Also:

- tests/src/smtp/inbound/spam_rules_kept.rs: an edited rule survives an
  update, an unedited one is updated, rules from before fingerprints are
  handled, and the audit summary says so. Upstream's own spam_rules test
  passes unchanged.
- tests/src/smtp/reporting/reschedule.rs moves to port 19058; upstream's
  new spam_rules test took 19057.
- tools/fork/renames.py renames the "(Stalwart)" labels and the default
  log path, so neither conflicts again.
- tools/fork/notice-check.py compares against the newest snapshot in the
  checked-out history instead of the upstream branch head, so moving the
  branch no longer fails other open pull requests.
- tests/src/directory/issuer.rs (since v0.16.23) stays out, and is on the
  build check's known list: it tests issuer-based directory routing, which
  the fork doesn't have (DIR-2).
- Strip report: docs/fork/strip-reports/v0.16.24.{md,json}.

tools/fork/README.md

@@ -57,8 +57,12 @@ under the reason it stays.
 
 Fails when an upstream file the fork changed doesn't carry the AGPL 5(a)
 notice, `Modified by Coffey Labs in <year> for INBUXA.`, under upstream's
-license line. "Changed" means it differs from the `upstream` branch, so the
-list comes from the diff, not from memory. CI runs it beside the name check.
+license line. "Changed" means it differs from the newest `upstream` snapshot
+in the checked-out history (found by its "Import upstream v…" subject, so CI
+needs a full clone), so the list comes from the diff, not from memory. A
+branch merging a new release is checked against that release, and other
+branches aren't affected when the `upstream` branch moves. CI runs it beside
+the name check.
 
 ```bash
 tools/fork/notice-check.py          # exit 1 on a missing notice

tools/fork/build-check-known.txt

@@ -7,6 +7,9 @@
 
 # OIDC directories: `main` has its own tests/src/directory/oidc.rs.
 tests/src/directory/mod.rs
+# Issuer-based directory routing (since v0.16.23), which `main` doesn't have
+# and doesn't carry the test for (DIR-2).
+tests/src/directory/issuer.rs
 # Tenants and archiving.
 tests/src/system/mod.rs
 # The LLM spam-filter classifier.

tools/fork/notice-check.py

@@ -13,9 +13,13 @@ beneath upstream's own notice:
 
      * Modified by Coffey Labs in 2026 for INBUXA.
 
-"Changed" is measured against the `upstream` branch, which holds the stripped
-upstream release `main` was last merged with (docs/spec/SPEC.md §2.2a), so
-the list is what actually differs rather than a guess. A file counts as
+"Changed" is measured against the newest stripped snapshot this tree has
+merged, a commit on the `upstream` branch (docs/spec/SPEC.md §2.2a), so the
+list is what actually differs rather than a guess. It's found in the tree's
+own history, by the strip's commit subject, not taken from the branch head:
+a branch that merges a new release is checked against it, and every other
+branch against the release it's built on, whenever the `upstream` branch
+moves. A file counts as
 upstream's when its header names Stalwart Labs as a copyright holder; files
 the fork wrote carry their own copyright and need nothing. Files with no
 comment header at all (README, manifests) are covered by the README's prose.
@@ -37,11 +41,11 @@ def git(*args):
 
 
 def snapshot_ref():
-    for ref in ('origin/upstream', 'upstream'):
-        if subprocess.run(['git', 'rev-parse', '--verify', '--quiet', f'{ref}^{{commit}}'],
-                          capture_output=True).returncode == 0:
-            return ref
-    sys.exit('notice-check: no upstream snapshot branch (origin/upstream or upstream); fetch it first')
+    ref = git('log', '-1', '--format=%h', '--grep=^Import upstream v',
+              '--grep=^Re-import upstream v', 'HEAD').strip()
+    if not ref:
+        sys.exit('notice-check: no upstream snapshot in this history; fetch it in full first')
+    return ref
 
 
 def changed_upstream_files(ref):

tools/fork/renames.py

@@ -46,6 +46,7 @@ TEXT_RENAMES = [
     # that must match their containers and identity provider (database users,
     # passwords, an OIDC audience), and name their databases explicitly.
     ('"stalwart".to_string()', '"inbuxa".to_string()', ('crates',)),
+    ('"/var/log/stalwart', '"/var/log/inbuxa', ('crates',)),
     # The spam filter rules ship with the server (common::manager::spam_rules);
     # upstream's default of fetching its latest from GitHub becomes unset.
     ('spam_filter_rules_url: Some("https://github.com/stalwartlabs/spam-filter/releases/latest/download/spam-filter-rules.json.gz".to_string()),',
@@ -62,6 +63,8 @@ SCHEMA_HASH = Path('resources/schema/schema.json.sha256')
 SCHEMA_RENAMES = [
     ('"stalwart"', '"inbuxa"'),
     ('vnd.stalwart', 'vnd.inbuxa'),
+    # Sieve extension labels, "(vnd.stalwart)" until upstream v0.16.24.
+    ('(Stalwart)"', '(vnd.inbuxa)"'),
     # The bundled spam rules: no default URL, and say what empty means.
     ('"spamFilterRulesUrl":"https://github.com/stalwartlabs/spam-filter/releases/latest/download/spam-filter-rules.json.gz",', ''),
     ('"URL to download spam filter rules from"',