feat: migrate Stalwart management API to JMAP x: methods (0.16)

Drops the 0.15 REST management API and routes all account/auth/crypto/
principal operations through Stalwart 0.16's schema-driven JMAP
endpoint via a single passthrough (/api/account/stalwart/jmap).

- New client helper `stalwartJmap` + typed `requireResult`
- account-security-store rewritten against x:AccountPassword, x:AppPassword,
  x:AccountSettings, x:Account (with currentSecret for TOTP ops)
- Client-side TOTP setup via `otpauth`; server-generated app password
  secrets shown once on create
- Admin check switched to /api/account permissions
  (sysAccountQuery/sysTenantQuery/sysSystemSettingsGet)
- Removed sieve vacation-overwrite workaround (fixed upstream #1251)
- Deleted old REST routes, StalwartClient, stale tests; added new
  tests for passthrough + store

lib/stalwart/credentials.ts

@@ -4,9 +4,7 @@ import { sessionCookieName } from '@/lib/auth/session-cookie';
 import { readStalwartAuthContextFromStore } from '@/lib/stalwart/auth-context';
 
 export interface StalwartCredentials {
-  /** URL for Stalwart management API calls (uses STALWART_API_URL if set, otherwise serverUrl) */
-  apiUrl: string;
-  /** URL of the JMAP server (for JMAP operations like password verification) */
+  /** URL of the JMAP server (used for JMAP + management method calls) */
   serverUrl: string;
   authHeader: string;
   username: string;
@@ -14,26 +12,6 @@ export interface StalwartCredentials {
   slot: number;
 }
 
-/**
- * Resolve the base URL for Stalwart management API requests.
- *
- * When the JMAP server sits behind a reverse proxy that only forwards
- * JMAP paths, the `/api/account/*` and `/api/principal/*` management
- * endpoints may not be exposed.  In that case, operators can set
- * `STALWART_API_URL` to point directly at the Stalwart HTTP listener
- * (e.g. `https://admin.example.com`).
- */
-function getStalwartApiUrl(jmapServerUrl: string): string {
-  const url = process.env.STALWART_API_URL || jmapServerUrl;
-  return url.replace(/\/+$/, '');
-}
-
-/**
- * Extract credentials from the incoming request.
- *
- * Credentials are read from a verified, httpOnly auth-context cookie that is
- * populated after a successful JMAP login or token refresh.
- */
 function parseSlot(raw: string | null): number | null {
   if (raw === null) return null;
   const slot = parseInt(raw, 10);
@@ -55,8 +33,7 @@ export async function getStalwartCredentials(request: NextRequest): Promise<Stal
     if (!context) continue;
 
     return {
-      apiUrl: getStalwartApiUrl(context.serverUrl),
-      serverUrl: context.serverUrl,
+      serverUrl: context.serverUrl.replace(/\/+$/, ''),
       authHeader: context.authHeader,
       username: context.username,
       hasSessionCookie: !!cookieStore.get(sessionCookieName(slot))?.value,