Enforce read-only outbound permissions in Stalwart

[giorgiobrullo]

Summary

• re-check emailSend at MAIL FROM, so permission changes affect existing SMTP sessions while authentication still succeeds
• suppress user Sieve-generated outbound mail when emailSend is denied, preserving inbound delivery through the existing Inbox fail-safe
• re-check queued authenticated and user-Sieve messages before delivery, while leaving DSNs, reports, and trusted server-generated mail alone
• preserve credential-specific scopes when rebuilding an authenticated SMTP access token

Rollout note

Deploy this fork change before Kagi Mail starts synchronizing read-only account permissions.

The new queue source bit distinguishes user Sieve mail from trusted autogenerated mail, but Sieve messages queued by an older binary only carry the legacy autogenerated bit. Those pre-deploy entries cannot be classified safely. Let the old queue drain or expire before running the Kagi Mail permission backfill.

Verification

• STORE=Sqlite cargo test -p tests smtp::inbound::auth::auth -- --exact --nocapture
• STORE=Sqlite cargo test -p tests smtp::queue::permission::queued_email_send_permission -- --exact --nocapture
• cargo check -p smtp -p email -p jmap
• cargo clippy -p smtp -p email -p jmap (passes with existing warnings)
• full jmap::jmap_tests reached and passed the modified VacationResponse and EmailSubmission phases, then failed later in an unrelated Contacts assertion (Jane's version of John's Address Book vs Test #1)

Fixes EMAIL-1314