Fix two things live testing on 0.15.5 turned up

**About said "not detected".** Generation was only worked out from the reply to
a registry method, which we never send to a server that does not advertise
urn:stalwart:jmap — every 0.16 build does, and nothing older knows the
capability at all, so its absence is already the answer. Say so, instead of
shrugging. A session with no capabilities at all stays unknown, which is a
different thing from old.

**The caret jumped out of the OTP field after one digit.** Dialog's autofocus
effect listed onClose in its dependencies, and every caller passes an inline
arrow, so each keystroke in a dialog holding state tore the effect down, set it
up again, and refocused the first field — which in the disable-2FA dialog is
the password. Keep the handler in a ref so the effect depends only on `open`.
This was a bug in the shared dialog rather than in one screen; every dialog
with more than one field had it.

The test for it fails against the old dependency array, not just passes
against the new one.

server/src/accountinfo.test.ts

@@ -1,6 +1,6 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { interpretAccountInfo } from "./upstream.js";
+import { getAccountInfo, interpretAccountInfo } from "./upstream.js";
 
 /**
  * The account locale used to be read only from `x:Account/get`, which needs
@@ -49,3 +49,19 @@ test("locales that carry no language are dropped, not passed through", () => {
   assert.equal(interpretAccountInfo([settingsOk("C")]).locale, null);
   assert.equal(interpretAccountInfo([settingsOk("POSIX")]).locale, null);
 });
+
+test("a server that never heard of the Stalwart capability is reported as pre-0.16", async () => {
+  // 0.16 always advertises urn:stalwart:jmap and nothing older knows it at all,
+  // so its absence is the answer - and asking anyway would fail the whole
+  // request on those servers. This is what the live 0.15.5 box hits.
+  const session = { capabilities: { "urn:ietf:params:jmap:core": {}, "urn:ietf:params:jmap:mail": {} }, accounts: {}, primaryAccounts: {} };
+  const info = await getAccountInfo("session-pre-016", "Basic x", session as never);
+  assert.equal(info.generation, "pre-0.16");
+  assert.equal(info.locale, null);
+  assert.equal(info.edition, null);
+});
+
+test("no capabilities at all leaves the generation unknown", async () => {
+  const info = await getAccountInfo("session-no-caps", "Basic x", { accounts: {}, primaryAccounts: {} } as never);
+  assert.equal(info.generation, null);
+});

server/src/upstream.ts

@@ -85,6 +85,8 @@ export interface AccountInfo {
 const infoCache = new Map<string, { info: AccountInfo; fetchedAt: number }>();
 const INFO_CACHE_MS = 30 * 60_000;
 const EMPTY_INFO: AccountInfo = { locale: null, generation: null, edition: null };
+/** A server that has never heard of the registry: nothing to read, but dated. */
+const PRE_REGISTRY_INFO: AccountInfo = { locale: null, generation: "pre-0.16", edition: null };
 
 /**
  * glibc modifiers that name a script rather than a dialect or a currency:
@@ -138,7 +140,12 @@ export function normalizeLocale(raw: unknown): string | null {
  * tells us which generation we are talking to.
  */
 async function fetchAccountInfo(authorization: string, session: UpstreamSession): Promise<AccountInfo> {
-  if (!session.capabilities || !(STALWART_CAP in session.capabilities)) return EMPTY_INFO;
+  // Every 0.16 build advertises urn:stalwart:jmap, and no earlier one knows it
+  // at all, so its absence already answers the question — and asking anyway
+  // would fail the whole request, since those servers reject a `using` naming
+  // a capability they cannot parse.
+  if (!session.capabilities) return EMPTY_INFO;
+  if (!(STALWART_CAP in session.capabilities)) return PRE_REGISTRY_INFO;
   const accountId =
     session.primaryAccounts?.[STALWART_CAP] ??
     session.primaryAccounts?.["urn:ietf:params:jmap:mail"] ??