DLP: how long held mail waits is a setting

inbuxa:DlpSettings (singleton, urn:inbuxa:jmap): keepHeldDays, 1 to 90,
7 by default (settled answer 5 made it a setting). sysDlpPolicyGet reads
it, sysDlpPolicyUpdate changes it, server-level, audited by the request
layer. Each held message keeps the days it was given, and the sender's
notices say that number. Privacy catalog entry; spec §2.6 updated.

mail_rules_tests: 7 by default, 0 refused, 3 set and a message held
afterwards expires 3 days after it was held, the expiry notice says 3.

crates/smtp/src/inbound/mailflow.rs

@@ -478,6 +478,9 @@ impl<T: SessionStream> Session<T> {
         size: u64,
     ) {
         let at = store::write::now();
+        let keep_days = held::settings(self.server.store())
+            .await
+            .map_or(KEEP_DAYS, |s| s.keep_held_days);
         let account = self.data.authenticated_as.as_ref();
         let record = Held {
             queue_id,
@@ -490,7 +493,8 @@ impl<T: SessionStream> Session<T> {
             rules: draft.rules,
             counts: draft.counts,
             held_at: at,
-            expires_at: at + KEEP_DAYS * 86_400,
+            expires_at: at + keep_days * 86_400,
+            keep_days,
         };
         if let Err(err) = held::create(self.server.store(), &record).await {
             trc::error!(

crates/smtp/src/queue/held.rs

@@ -24,7 +24,7 @@ use common::{
 };
 use inbuxa_features::{
     audit::{Action, Actor, Outcome, Record, Target},
-    mailflow::held::{self, HOLD_SECONDS, Held, KEEP_DAYS},
+    mailflow::held::{self, HOLD_SECONDS, Held},
 };
 use mail_builder::{
     MessageBuilder,
@@ -83,7 +83,8 @@ pub async fn reject(server: &Server, record: &Held, note: Option<&str>) -> trc::
     match note {
         Some(note) => text.push_str(&format!("\r\nThe reviewer's note: {note}\r\n")),
         None => text.push_str(&format!(
-            "\r\nNobody reviewed it within {KEEP_DAYS} days, so it was returned.\r\n"
+            "\r\nNobody reviewed it within {} days, so it was returned.\r\n",
+            record.keep_days
         )),
     }
     notify(
@@ -107,9 +108,10 @@ pub async fn notify_held(server: &Server, record: &Held) {
         .join(" ");
     let text = format!(
         "Your message \"{}\" to {} is held for review under this server's rules: {notices}\r\n\r\n\
-         It will be sent if a reviewer releases it, and returned otherwise within {KEEP_DAYS} days.\r\n",
+         It will be sent if a reviewer releases it, and returned otherwise within {} days.\r\n",
         record.subject,
         record.recipients.join(", "),
+        record.keep_days,
     );
     notify(
         server,
@@ -166,7 +168,8 @@ pub async fn expire(server: &Server) -> trc::Result<usize> {
                 },
                 changes: vec![],
                 details: Some(format!(
-                    "Rejected: nobody reviewed it within {KEEP_DAYS} days; the sender was told"
+                    "Rejected: nobody reviewed it within {} days; the sender was told",
+                    record.keep_days
                 )),
                 reason: None,
                 outcome: Outcome::success(),