AGPL source offer and name cleanup

Every build writes the exact source it was built from, uncommitted work and
new files included, as source.tar.gz next to the app, named after that tree.
Docker builds, which have no git, pack the build context and name it by a
hash of its files. The sign-in page and Settings > About link to it instead of
a repository that can drift.

What users, operators and packagers see no longer names the upstream server:
- interface text, in all nine catalogues, with a token-session line for
  Security;
- server messages;
- the settings, now MAIL_SERVER_URL, MAIL_SERVERS_FILE, ADMIN_URL and
  MAIL_SERVER_FOLLOW_ADVERTISED_URLS, and mail-servers.example.json;
- the Tenants notice, which is gone;
- the README, CONTRIBUTING and SECURITY.

ihasmail's own FEATURES, KNOWN-ISSUES and ROADMAP stay with public ihasmail,
and INBUXA.md is folded into the README.

web/vite.config.ts

@@ -3,11 +3,31 @@ import react from "@vitejs/plugin-react";
 import { fileURLToPath, URL } from "node:url";
 import { resolveVersion } from "../scripts/version.mjs";
 import { baseUrlOf } from "../scripts/basePath.mjs";
+import { sourceIdentity, writeSourceArchive } from "../scripts/source-archive.mjs";
 
 // Resolved here, at build time: the browser has no git to ask, and neither does
 // the Docker build, which is handed the answer as IHASMAIL_VERSION instead.
 const version = resolveVersion();
 
+/*
+ * ihasmail-inbuxa: the AGPL's offer for this build. The whole project's source
+ * (web and server), exactly as built, goes into dist/source.tar.gz, and its
+ * identity into the app so the download link can name it. See
+ * scripts/source-archive.mjs.
+ */
+const projectRoot = fileURLToPath(new URL("..", import.meta.url));
+const source = sourceIdentity(projectRoot);
+
+function sourceArchive(): Plugin {
+  return {
+    name: "inbuxa-source-archive",
+    apply: "build",
+    closeBundle() {
+      writeSourceArchive(projectRoot, fileURLToPath(new URL("./dist/source.tar.gz", import.meta.url)), "ihasmail-inbuxa", source);
+    },
+  };
+}
+
 /*
  * Where the app is mounted. Unlike everything else ihasmail is told, this one
  * cannot wait until the process starts: the hashed asset URLs are written into
@@ -59,8 +79,8 @@ function assetList(): Plugin {
 
 export default defineConfig({
   base,
-  plugins: [react(), assetList()],
-  define: { __IHASMAIL_VERSION__: JSON.stringify(version) },
+  plugins: [react(), assetList(), sourceArchive()],
+  define: { __IHASMAIL_VERSION__: JSON.stringify(version), __SOURCE_ID__: JSON.stringify(source.id) },
   resolve: {
     alias: { "@": fileURLToPath(new URL("./src", import.meta.url)) },
   },