Let an operator turn administration off

ADMINISTRATION=0 at launch removes in-app administration for everyone. The
account's permissions are no longer sent to the browser, so the menu never
appears, and the JMAP proxy refuses Stalwart registry methods other than the
account's own (settings, password, app passwords, API keys, public keys,
masked addresses). Hiding the menu alone would have left an administrator's
browser console able to make every call the menu made.

With administration on, the request body streams through untouched as before;
only an installation that turns it off reads and checks the body, forwarding
the parsed form so the server receives exactly what was inspected.

web/src/jmap/types.ts

@@ -39,6 +39,8 @@ export interface JmapSession {
       /** "oss" | "community" | "enterprise". Stalwart publishes no version. */
       edition?: string | null;
     };
+    /** False when the operator has turned in-app administration off. */
+    administration?: boolean;
     /**
      * The account's effective permissions on that server, as Stalwart reports
      * them. What the client offers is shaped by these; what is allowed is

web/src/views/admin/usePermissions.ts

@@ -11,6 +11,7 @@ import { permissionSet, type Permissions } from "@/lib/adminAccess";
  * everything that depends on it, whose requests could bring another refresh.
  */
 export function usePermissions(): Permissions {
-  const key = useSession((s) => (s.session?.ihasmail?.permissions ?? []).join(","));
+  // An installation with administration off sends none; this is belt and braces.
+  const key = useSession((s) => (s.session?.ihasmail?.administration === false ? "" : (s.session?.ihasmail?.permissions ?? []).join(",")));
   return useMemo(() => permissionSet(key ? key.split(",") : []), [key]);
 }