feat: migrate Stalwart management API to JMAP x: methods (0.16)

Drops the 0.15 REST management API and routes all account/auth/crypto/
principal operations through Stalwart 0.16's schema-driven JMAP
endpoint via a single passthrough (/api/account/stalwart/jmap).

- New client helper `stalwartJmap` + typed `requireResult`
- account-security-store rewritten against x:AccountPassword, x:AppPassword,
  x:AccountSettings, x:Account (with currentSecret for TOTP ops)
- Client-side TOTP setup via `otpauth`; server-generated app password
  secrets shown once on create
- Admin check switched to /api/account permissions
  (sysAccountQuery/sysTenantQuery/sysSystemSettingsGet)
- Removed sieve vacation-overwrite workaround (fixed upstream #1251)
- Deleted old REST routes, StalwartClient, stale tests; added new
  tests for passthrough + store

components/settings/vacation-settings.tsx

@@ -5,7 +5,6 @@ import { useTranslations } from 'next-intl';
 import { SettingsSection, SettingItem, ToggleSwitch } from './settings-section';
 import { Button } from '@/components/ui/button';
 import { useVacationStore } from '@/stores/vacation-store';
-import { useFilterStore } from '@/stores/filter-store';
 import { useAuthStore } from '@/stores/auth-store';
 import { Loader2, AlertTriangle, Eye, EyeOff } from 'lucide-react';
 import { toast } from '@/stores/toast-store';
@@ -104,19 +103,6 @@ export function VacationSettings() {
         textBody: localTextBody,
       });
 
-      // Re-save the filter script to preserve metadata and include vacation block.
-      // This prevents the server from injecting vacation Sieve code that destroys
-      // the metadata comment the visual filter builder relies on.
-      try {
-        await useFilterStore.getState().syncVacationToScript(client, {
-          isEnabled: localEnabled,
-          subject: localSubject,
-          textBody: localTextBody,
-        });
-      } catch {
-        // Non-critical: vacation was saved via JMAP, script sync is best-effort
-      }
-
       toast.success(tNotifications('vacation_saved'));
     } catch (error) {
       console.error('Failed to save vacation response:', error);