Import upstream v0.16.24, stripped

Upstream commit: af37a234981722493b74623a983581691d2b70b6
Enterprise-only files removed or emptied: 63
Enterprise-only snippets removed: 118 in 50 files
Dangling module declarations removed: 5
Edits turning enterprise off: 25
Third-party code: 14 files, 0 not in THIRD-PARTY.md
Renamed identifiers: 62 in 18 files
Verification: clean

The same Enterprise footprint as v0.16.23. The build check fails only on
tests/src/directory/issuer.rs, unchanged since v0.16.23: it calls a helper
from upstream's Enterprise-only OIDC test, and tests issuer-based directory
routing, an Enterprise feature. main has never carried it.

tests/src/imap/antispam.rs

@@ -129,6 +129,21 @@ pub async fn test(test: &TestServer) {
     assert_eq!(samples.iter().filter(|x| !x.1.is_spam).count(), 11);
     assert_eq!(samples.iter().filter(|x| x.1.is_spam).count(), 11);
 
+    let last_id = samples.iter().map(|(id, _)| id.id()).max().unwrap();
+    for _ in 0..2 {
+        admin
+            .registry_create_object(Task::SpamFilterMaintenance(TaskSpamFilterMaintenance {
+                maintenance_type: TaskSpamFilterMaintenanceType::Train,
+                status: TaskStatus::now(),
+            }))
+            .await;
+        test.wait_for_tasks().await;
+        let model = spam_classifier_model(&test.server).await;
+        assert_eq!(model.reservoir.ham.total_seen, 11);
+        assert_eq!(model.reservoir.spam.total_seen, 11);
+        assert_eq!(model.last_id, last_id);
+    }
+
     // Global spam samples should not appear in the account
     let samples = account.spam_training_samples().await;
     assert_eq!(samples.iter().filter(|x| !x.1.is_spam).count(), 11);