Record the roles run on the live server, and drop the mock's made-up permission

A throwaway role on the production server confirmed the create shape,
one-pointer changes to permissions, bases and name together, the grant
refusal, and the in-use refusal when another role builds on it. It also
showed that a permission name Stalwart does not know fails the whole
update -- which is how jmapEmailSet, carried by the mock since Accounts
was built, turned out not to exist. The mock uses jmapEmailUpdate and now
refuses unknown names against the 0.16.22 snapshot.

Some permissions an administrator holds are never listed by /api/account
(sysLogCreate was granted without complaint), so the picker locks their
Allow; KNOWN-ISSUES says so.

server/src/mock/directory.test.ts

@@ -248,3 +248,10 @@ test("the default roles are read from the authentication settings", () => {
   assert.deepEqual(list[0]!.defaultUserRoleIds, { r1: true });
   assert.throws(() => make("tenant-admin").handlers["x:Authentication/get"]!({}), (e: Refused) => e.type === "forbidden");
 });
+
+test("a permission name Stalwart does not know fails the whole change", () => {
+  const dir = make("admin");
+  const r = dir.handlers["x:Role/set"]!({ update: { r4: { "enabledPermissions/notARealPermission": true, description: "Renamed" } } }) as { notUpdated?: Record<string, { type: string; properties: string[] }> };
+  assert.equal(r.notUpdated?.r4?.type, "invalidPatch");
+  assert.deepEqual(r.notUpdated!.r4!.properties, ["enabledPermissions/notARealPermission"]);
+});