Restore administrator roles that migrate_v016.py drops

Chased down why a migrated instance had no working administrator. The
account authenticated fine and was refused every management call, and the
cause is that migrate_v016.py assigns every migrated account the User role
regardless of what it held before: an account that was `roles: ["admin"]`
in v0.15 comes out the far side as `roles: {"@type": "User"}`.

Ordinary users were never affected - User is what they had and what they
get - and their credentials, mail and mailboxes survive untouched. It is
specifically administrators who lose their privileges, which is a bad thing
to discover after cutting over.

The v0.16 shape came from the server's own schema document rather than the
published reference: GET /api/schema defines x:UserRoles as a multi-variant
type with variants User, Admin and Custom. Account is itself multi-variant,
so an upsert needs its own "@type" too - without it the server rejects the
operation outright ("upsert entry is missing `@type`").

applyplan.AccountRoleOperations restores roles from the principals dump,
emitting operations only for accounts whose role actually changes.
Rewriting every account would be a much larger blast radius for no benefit.
Where v0.15 listed several roles, admin wins - under-privileging an
administrator locks them out, which is the failure being fixed - and the
collapse is reported rather than done silently, as are roles with no known
v0.16 equivalent.

Verified end to end on the smoke VM: rehearse against the real 0.15.5 put
the role operation in the supplement, applying that supplement to a
migrated 0.16.14 whose admin was broken restored management access
(accounts=3), and alice and bob logged in over IMAPS with unchanged
credentials, read their mail, and accepted new SMTP delivery.

Also recorded: x:Account.domainId returns an internal id on v0.16, not a
domain name, so the post-migration directory comparison would read every
domain as missing. Resolving that needs an x:Domain/get call not yet
confirmed against the binary.

cmd/stalwart-migrate/rehearse.go

@@ -222,7 +222,7 @@ func runRehearse(args []string) (err error) {
 	// worth having precisely because it is honest about how much of the
 	// worklist it does not touch.
 	fmt.Println("\n--- supplemental plan (best-effort) ---")
-	if err := generateSupplement(store, rs, settingsPath, unmigratedPath, keptSupplement); err != nil {
+	if err := generateSupplement(store, rs, settingsPath, principalsPath, unmigratedPath, keptSupplement); err != nil {
 		fmt.Fprintf(os.Stderr, "warning: couldn't generate the supplemental plan: %v\n", err)
 	}
 	if err := store.Save(rs); err != nil {
@@ -264,7 +264,7 @@ func copyFile(src, dst string) error {
 // it: the official conversion is the authority on everything it handles,
 // and a generated plan that overlapped it could silently override a
 // correct mapping with a guessed one.
-func generateSupplement(store *checkpoint.Store, rs *checkpoint.RunState, settingsPath, unmigratedPath, outPath string) error {
+func generateSupplement(store *checkpoint.Store, rs *checkpoint.RunState, settingsPath, principalsPath, unmigratedPath, outPath string) error {
 	settings, err := backup.ReadSettingsDump(settingsPath)
 	if err != nil {
 		return err
@@ -278,6 +278,24 @@ func generateSupplement(store *checkpoint.Store, rs *checkpoint.RunState, settin
 	if err != nil {
 		return err
 	}
+
+	// Account roles don't live in the settings dump, so they come from the
+	// principals dump rather than through a settings Generator. Without
+	// this the migrated instance has no administrator: migrate_v016.py
+	// gives every account the User role, whatever it had before.
+	principals, err := backup.ReadPrincipalsDump(principalsPath)
+	if err != nil {
+		return err
+	}
+	roleOps, _, roleWarnings, err := applyplan.AccountRoleOperations(principals)
+	if err != nil {
+		return err
+	}
+	plan.Operations = append(plan.Operations, roleOps...)
+	coverage.Warnings = append(coverage.Warnings, roleWarnings...)
+	if len(roleOps) > 0 {
+		coverage.ObjectsByType["Account role"] += len(roleOps)
+	}
 	if len(plan.Operations) == 0 {
 		fmt.Println("nothing this tool can rebuild automatically yet - the whole worklist is manual")
 		return nil