Merge upstream v0.16.23

Five conflicts, resolved:

- crates/common/src/auth/authentication.rs: upstream's get_directory_for_token
  and JwtClaims replace extract_jwt_domain; the per-domain directory code
  (DIR-1, DIR-5 to DIR-7) is kept, and the token lookup routes through it.
  The release's one new Enterprise snippet was the body of
  get_directory_for_issuer, which stays returning None: a token naming no
  address gets the server default, as DIR-2 specifies and as v0.16.22 did.
- crates/common/src/manager/application.rs: upstream's rewrite of the tests,
  with the temp directory names renamed again, and the 5(a) notice the
  name-purge change should have added.
- crates/common/src/network/mta.rs: both sides' imports.
- crates/main/Cargo.toml: the AGPL-only license kept, version 0.16.23.
- Cargo.lock: upstream's, with the fork's crates added by Cargo.

crates/services/src/broadcast/subscriber.rs

@@ -96,6 +96,13 @@ pub fn spawn_broadcast_subscriber(inner: Arc<Inner>, mut shutdown_rx: watch::Rec
                                     }
                                 };
 
+                                inner
+                                    .shared_core
+                                    .load()
+                                    .storage
+                                    .data
+                                    .invalidate_read_snapshot();
+
                                 loop {
                                     match batch.next_event() {
                                         Ok(Some(event)) => {
@@ -174,9 +181,7 @@ pub fn spawn_broadcast_subscriber(inner: Arc<Inner>, mut shutdown_rx: watch::Rec
                                                             .await;
                                                 }
                                                 BroadcastEvent::QueueRefresh => {
-                                                    let core = inner.shared_core.load_full();
-                                                    if core.network.roles.outbound_mta {
-                                                        core.storage.data.invalidate_read_snapshot();
+                                                    if inner.shared_core.load().network.roles.outbound_mta {
                                                         let _ = inner
                                                                 .ipc
                                                                 .queue_tx
@@ -185,9 +190,7 @@ pub fn spawn_broadcast_subscriber(inner: Arc<Inner>, mut shutdown_rx: watch::Rec
                                                     }
                                                 }
                                                 BroadcastEvent::RegistryChange(change) => {
-                                                    let server = inner.build_server();
-                                                    server.store().invalidate_read_snapshot();
-                                                    match Box::pin(server.reload_registry(change)).await {
+                                                    match Box::pin(inner.build_server().reload_registry(change)).await {
                                                         Ok(result) => {
                                                             result.log();
                                                         }