Add Domains to Administration

A role that can read domains now finds a Domains section beside Accounts:
list and search with each domain's account count and whether its DNS, DKIM
and certificate are managed automatically; add a domain; edit its
description, other names, catch-all address and plus addressing; copy its
DNS records one at a time or as a zone file; see its DKIM keys and their
stage; and remove it once no accounts use it.

The records come from the zone file Stalwart computes per domain. A long
DKIM record, which the BIND serialiser splits into quoted chunks, is joined
back into the single value a DNS provider's form wants.

Removing a domain takes its DKIM keys first, in the same request, because the
server will not remove a domain its keys still name. Removal is not offered
while accounts use the domain, or when the role cannot remove the keys.

The Administration nav is now built from the sections the role can read, and
the menu appears when there is at least one. The mock gains domains, DKIM
keys and zone files.

61 new strings, translated in all nine catalogues; strings falling back to
English stay at 16.

web/src/lib/adminAccess.ts

@@ -27,14 +27,24 @@ export function can(perms: Permissions, object: AdminObject, op: AdminOp): boole
   return perms.has(`sys${object}${op}`);
 }
 
+export type AdminSection = "accounts" | "domains";
+
 /**
- * Whether to offer Administration at all.
+ * The sections an account may open, in the order they are listed.
  *
- * Accounts are the only section so far, and a list that cannot be opened is
- * not worth a menu entry, so it takes both halves of reading one.
+ * A list that cannot be read is not worth an entry, so each takes both halves
+ * of reading one: the query that finds the objects and the get that shows them.
  */
+export function adminSections(perms: Permissions): AdminSection[] {
+  const out: AdminSection[] = [];
+  if (can(perms, "Account", "Query") && can(perms, "Account", "Get")) out.push("accounts");
+  if (can(perms, "Domain", "Query") && can(perms, "Domain", "Get")) out.push("domains");
+  return out;
+}
+
+/** Whether to offer Administration at all: when there is a section to open. */
 export function hasAdministration(perms: Permissions): boolean {
-  return can(perms, "Account", "Query") && can(perms, "Account", "Get");
+  return adminSections(perms).length > 0;
 }
 
 /**