Merge upstream v0.16.23

Five conflicts, resolved:

- crates/common/src/auth/authentication.rs: upstream's get_directory_for_token
  and JwtClaims replace extract_jwt_domain; the per-domain directory code
  (DIR-1, DIR-5 to DIR-7) is kept, and the token lookup routes through it.
  The release's one new Enterprise snippet was the body of
  get_directory_for_issuer, which stays returning None: a token naming no
  address gets the server default, as DIR-2 specifies and as v0.16.22 did.
- crates/common/src/manager/application.rs: upstream's rewrite of the tests,
  with the temp directory names renamed again, and the 5(a) notice the
  name-purge change should have added.
- crates/common/src/network/mta.rs: both sides' imports.
- crates/main/Cargo.toml: the AGPL-only license kept, version 0.16.23.
- Cargo.lock: upstream's, with the fork's crates added by Cargo.

crates/services/src/task_manager/index.rs

@@ -6,7 +6,7 @@
  * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
-use crate::task_manager::{Task, TaskDetails, TaskFailureType, TaskResult};
+use crate::task_manager::{Task, TaskDetails, TaskFailureType, TaskResult, deferred_retry_time};
 use common::Server;
 use email::{
     cache::MessageCacheFetch,
@@ -274,7 +274,7 @@ impl SearchIndexTask for Server {
             );
             for r in results.iter_mut() {
                 if r.task_type == TaskType::Insert && r.result.is_success() {
-                    r.result = search_store_failure(retry_at, "Failed to index documents");
+                    r.result = TaskResult::deferred(retry_at, "Failed to index documents");
                 }
             }
             return results;
@@ -331,7 +331,7 @@ impl SearchIndexTask for Server {
                 for r in results.iter_mut() {
                     if r.task_type == TaskType::Delete && r.result.is_success() {
                         r.result =
-                            search_store_failure(retry_at, "Failed to delete documents from index");
+                            TaskResult::deferred(retry_at, "Failed to delete documents from index");
                     }
                 }
                 return results;
@@ -445,22 +445,6 @@ pub(crate) async fn reindex_account(server: &Server, account_id: u32) -> trc::Re
     Ok(())
 }
 
-fn deferred_retry_time(err: &trc::Error) -> Option<u64> {
-    err.value(trc::Key::NextRetry)
-        .and_then(|value| value.to_uint())
-}
-
-fn search_store_failure(retry_at: Option<u64>, message: &'static str) -> TaskResult {
-    match retry_at {
-        Some(retry_at) => TaskResult::Failure {
-            typ: TaskFailureType::Retry(retry_at),
-            message: message.into(),
-            max_attempts: None,
-        },
-        None => TaskResult::temporary(message),
-    }
-}
-
 fn attempt_number(status: &TaskStatus) -> u64 {
     match status {
         TaskStatus::Pending(_) => 0,