DLP: how long held mail waits is a setting

inbuxa:DlpSettings (singleton, urn:inbuxa:jmap): keepHeldDays, 1 to 90,
7 by default (settled answer 5 made it a setting). sysDlpPolicyGet reads
it, sysDlpPolicyUpdate changes it, server-level, audited by the request
layer. Each held message keeps the days it was given, and the sender's
notices say that number. Privacy catalog entry; spec §2.6 updated.

mail_rules_tests: 7 by default, 0 refused, 3 set and a message held
afterwards expires 3 days after it was held, the expiry notice says 3.

docs/spec/features/dlp-and-mail-flow-rules.md

@@ -304,8 +304,9 @@ held mail, so what's released is what would have gone out. The daily
 clean-up rejects what's past its 7 days (recorded as the server's doing).
 `preview` returns the text (64 KB) only when asked for, and each read is
 recorded as `blobAccess`. Emails › Queue refuses to change or delete held
-mail, and the sender can't unsend it. The 7 days is a constant for now; a
-setting comes with the console page.
+mail, and the sender can't unsend it. How many days held mail waits is
+`inbuxa:DlpSettings.keepHeldDays`, 1 to 90, 7 by default; each held message
+keeps the days it was given.
 
 ### 2.7 What's recorded