DLP: how long held mail waits is a setting

inbuxa:DlpSettings (singleton, urn:inbuxa:jmap): keepHeldDays, 1 to 90,
7 by default (settled answer 5 made it a setting). sysDlpPolicyGet reads
it, sysDlpPolicyUpdate changes it, server-level, audited by the request
layer. Each held message keeps the days it was given, and the sender's
notices say that number. Privacy catalog entry; spec §2.6 updated.

mail_rules_tests: 7 by default, 0 refused, 3 set and a message held
afterwards expires 3 days after it was held, the expiry notice says 3.

crates/smtp/src/inbound/mailflow.rs

@@ -478,6 +478,9 @@ impl<T: SessionStream> Session<T> {
         size: u64,
     ) {
         let at = store::write::now();
+        let keep_days = held::settings(self.server.store())
+            .await
+            .map_or(KEEP_DAYS, |s| s.keep_held_days);
         let account = self.data.authenticated_as.as_ref();
         let record = Held {
             queue_id,
@@ -490,7 +493,8 @@ impl<T: SessionStream> Session<T> {
             rules: draft.rules,
             counts: draft.counts,
             held_at: at,
-            expires_at: at + KEEP_DAYS * 86_400,
+            expires_at: at + keep_days * 86_400,
+            keep_days,
         };
         if let Err(err) = held::create(self.server.store(), &record).await {
             trc::error!(