Rename the identifiers that carried the upstream name

Everything clients, users and operators meet now carries the fork's name,
with no aliases (SPEC.md §2.4, changed here from "protocol identifiers
stay"):

- JMAP: upstream's registry capability is urn:inbuxa:jmap:registry, beside
  the fork's own urn:inbuxa:jmap.
- WebDAV lock and sync tokens are urn:inbuxa:dav*; clients resync once.
- Sieve: vnd.inbuxa.while and vnd.inbuxa.expressions. sieve-rs spells these
  into its compiler, so it's vendored (vendor/sieve-rs, 0.7.3) and patched in;
  a unit test fails if Cargo.lock ever moves past the vendored copy. The
  trusted runtime now names itself too, rather than answering sieve-rs's
  default.
- The web interface's OAuth client is inbuxa-webui. On every start the old
  stalwart-webui client is removed and any application naming it is moved
  over.
- The spam filter's blobs are INBUXA_SPAM_*; every start moves any left
  under the old keys, so a trained model survives.
- SQL stores and log files default to inbuxa, in the code and in the
  schema served to the admin (checksum regenerated).
- Settings are INBUXA_* only. A STALWART_* variable that's set where its
  INBUXA_* one isn't stops the server at startup, naming it.
- The version-upgrade messages link docs.inbuxa.org's migration page, and
  the OpenAPI description, smtp crate metadata and web-push test fixtures
  lose the name.

Kept on purpose, allowlisted with reasons: the OAuth key-derivation
contexts (renaming them would end every session and invalidate every
sealed client id) and the hashed application prefix.

Also fixes a latent start-up failure: ensure_client updated an existing
first-party client with a revision of 0, which the registry's assertion
never matches, so adding a redirect URI or changing the webmail secret
failed start-up. And the principal session test now expects
legacyProtocols (C-1, added 2026-09-21), which it had missed.

Tested: the server builds without warnings; common's 106 unit tests,
including the vendoring check; a new integration test for the two
start-up migrations; and the webdav, jmap, imap and SMTP Sieve suites.

tools/fork/name-allowlist.txt

@@ -2,58 +2,27 @@
 # Read by tools/fork/name-check.py. One per line: path<TAB>literal as a JSON
 # string, as `name-check.py --list` prints it. Each group says why it stays;
 # add a line only under a reason, or with a new one.
+#
+# Everything clients, users and operators meet was renamed on 2026-09-22
+# (docs/spec/SPEC.md §2.4, tools/fork/renames.py). What's left is invisible,
+# or names the old spelling in order to retire it.
 
-# Key-derivation contexts. Renaming them invalidates every sealed OAuth token
-# and client id already issued.
+# Key-derivation contexts. Nobody sees them, and renaming them would
+# invalidate every sealed OAuth token and client id already issued.
 crates/common/src/auth/oauth/client_id.rs	"stalwart-oauth-client-id-sw1"
 crates/common/src/auth/oauth/token.rs	"stalwart-oauth-token-sw1"
 
-# Keys and prefixes of data already in the store.
+# Hashed before it's used as a blob key, so it never appears anywhere.
 crates/common/src/manager/application.rs	"STALWART_APP_"
-crates/common/src/manager/mod.rs	"STALWART_SPAM_CLASSIFIER_MODEL.lz4"
-crates/common/src/manager/mod.rs	"STALWART_SPAM_TRAIN_DATA.lz4"
 
-# The web interface's OAuth client id, which existing installs and the admin
-# front end already use. The id itself, and the tests that check it.
+# Pre-rename names, read only to retire them: the web interface's OAuth
+# client (removed on start), the spam filter's blobs (moved to their new
+# keys), and the environment prefix (refused with the variable to rename).
 crates/common/src/manager/first_party.rs	"stalwart-webui"
-crates/common/src/manager/application.rs	"stalwart-webui"
-crates/common/src/manager/application.rs	"<meta name=\\\"oauth-client-id\\\" content=\\\"stalwart-webui\\\" />"
+crates/migration/src/lib.rs	"STALWART_SPAM_CLASSIFIER_MODEL.lz4"
+crates/migration/src/lib.rs	"STALWART_SPAM_TRAIN_DATA.lz4"
+crates/types/src/branding.rs	"STALWART"
 
-# Wire-protocol identifiers clients already hold or negotiate: WebDAV lock and
-# sync tokens, the JMAP capability, Sieve extensions.
-crates/dav/src/common/lock.rs	"urn:stalwart:davsync:"
-crates/dav/src/common/uri.rs	"urn:stalwart:"
-crates/dav/src/common/uri.rs	"urn:stalwart:davlock:{id:x}"
-crates/dav/src/common/uri.rs	"urn:stalwart:davsync:"
-crates/dav/src/common/uri.rs	"urn:stalwart:davsync:{id:x}"
-crates/dav/src/common/uri.rs	"urn:stalwart:davsync:{id:x}:{seq:x}"
-crates/jmap-proto/src/request/capability.rs	"urn:stalwart:jmap"
-crates/registry/src/schema/enums_impl.rs	"vnd.stalwart.expressions"
-crates/registry/src/schema/enums_impl.rs	"vnd.stalwart.while"
-
-# Moving an existing upstream installation over: its environment variables,
-# and upstream's upgrade guide for the store conversion.
-crates/types/src/branding.rs	"STALWART_{name}"
-crates/types/src/branding.rs	"Warning: STALWART_{name} is deprecated; set INBUXA_{name} instead."
-crates/store/src/build/registry.rs	"⚠️  INBUXA_RECOVERY_ADMIN (or STALWART_RECOVERY_ADMIN) is set, but the"
-crates/jmap/src/registry/mapping/bootstrap.rs	"https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md"
-crates/migration/src/lib.rs	"https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md"
-
-# Upstream's published spam-filter rules, fetched at runtime.
+# OPEN, not yet decided (2026-09-22): upstream's published spam-filter rules,
+# which the server downloads at runtime from this address.
 crates/registry/src/schema/structs_impl.rs	"https://github.com/stalwartlabs/spam-filter/releases/latest/download/spam-filter-rules.json.gz"
-
-# Test fixtures: web-push contact address parsing.
-crates/common/src/network/webpush.rs	"  [email protected]  "
-crates/common/src/network/webpush.rs	"MAILTO:[email protected]"
-crates/common/src/network/webpush.rs	"[email protected]"
-crates/common/src/network/webpush.rs	"http://stalw.art"
-crates/common/src/network/webpush.rs	"https://stalw.art/contact"
-crates/common/src/network/webpush.rs	"mailto:[email protected]"
-crates/common/src/network/webpush.rs	"stalw.art"
-
-# OPEN, not yet decided (2026-09-22): operator-visible defaults. The log file
-# prefix (TracerLog, and the bootstrap's tracer) names files stalwart.* in
-# /var/log/inbuxa/, and the SQL stores default their database and user to
-# "stalwart". Changing the SQL defaults would break an install relying on them.
-crates/jmap/src/registry/mapping/bootstrap.rs	"stalwart"
-crates/registry/src/schema/structs_impl.rs	"stalwart"

tools/fork/name-check.py

@@ -13,7 +13,8 @@ names, descriptions -- carries INBUXA's. Merging an upstream release brings
 new strings in with the name, and the merge itself can't tell, so this runs
 in CI on every push and pull request.
 
-Scope: string literals in `crates/**/*.rs`, test directories excluded.
+Scope: string literals in `crates/**/*.rs` and `vendor/**/*.rs`, test
+directories excluded.
 Comments are skipped, so copyright headers and doc comments never match.
 Some literals have to keep the name -- key-derivation contexts, wire-protocol
 identifiers, defaults that read an upstream installation -- and those are
@@ -79,8 +80,14 @@ def literals(src):
 
 def findings():
     found = set()
-    crates = os.path.join(ROOT, 'crates')
-    for dirpath, dirnames, filenames in os.walk(crates):
+    for top in ('crates', 'vendor'):
+        found |= findings_under(os.path.join(ROOT, top))
+    return found
+
+
+def findings_under(top):
+    found = set()
+    for dirpath, dirnames, filenames in os.walk(top):
         dirnames[:] = sorted(d for d in dirnames if d not in SKIP_DIRS)
         for f in sorted(filenames):
             if not f.endswith('.rs'):