Fork tooling: record what the compat tests compare against

Three of the eight compat tests check INBUXA's data against a recording of
how the Enterprise server read it, and that recording can only be made
while that server is still up. SPEC §7 gives it 45 days from the notice, so
the capture shouldn't wait on the cutover being scheduled.

record-compat.py writes all three files: the tenants with their quotas and
members and what each tenant administrator sees, every masked address and
its state, and every archived item whole, since undelete_compat compares
every property it recorded. It only reads, and refuses to send a method
that isn't /get or /query, because it is the one tool here that runs
against the live server. Queries follow their pages, so a server that caps
one doesn't leave a short recording behind.

Exercised against the fork's own test server, which answers the same JMAP:
3 tenants with members, 8 masked addresses and 3 archived items, each in
the shape its test reads.

tools/fork/README.md

@@ -20,3 +20,15 @@ licenses. Files marked **new** need their notice added to `THIRD-PARTY.md`
 at the repository root before the import is merged.
 
 It needs Python 3.12+ (for `tarfile`'s `data` filter) and git.
+
+## record-compat.py
+
+Records what the `*_compat` tests compare against, from the Enterprise
+server, while it is still running. Read-only: `/get` and `/query` only.
+See `docs/spec/compat-tests.md`.
+
+```bash
+tools/fork/record-compat.py --server https://mail.example.org \
+    --admin '[email protected]:PASSWORD' --out ./compat \
+    --tenant-admin '[email protected]:PASSWORD'
+```