Contract spec: inbuxa-server, ihasmail-inbuxa and INBUXA Admin

Discovery and a contract version in the session; front ends configured once
(x:FrontEnds); OAuth with required registration, first-party clients,
server-hosted sign-in and consent for everything else; per-grant revocation;
cross-origin limited to the front ends; an admin lane by scope; push
unchanged. Records what upstream does today, including that it accepts any
client and redirect URI by default, and the phishing that allows.

docs/spec/SPEC.md

@@ -336,6 +336,9 @@ which this design exists to avoid.
 
 ### 5.2 The contract between them
 
+The full contract is in `contract.md` (drafted 2026-09-18). What follows is
+the summary it expands.
+
 Versioned, and advertised in the JMAP session so either side can check it.
 
 - **Discovery.** The server's session names its webmail URL and the contract
@@ -510,7 +513,7 @@ before anything that could prompt that notice happens.
 
 ## 8. Open decisions
 
-- The INBUXA fork of ihasmail: its name, its repository, and how it tracks
+- The INBUXA fork of ihasmail is **ihasmail-inbuxa** (named 2026-09-18). Open: its repository, and how it tracks
   public ihasmail (§5).
 - Product name: whether the shipped product is called inbuxa-server or
   something else inside the INBUXA brand.