Undelete: deleted email is kept, restored where it was, and managed over x:ArchivedItem (UD-1 to UD-14 for email)

Every way of deleting mail for good (JMAP, IMAP expunge, POP3, Trash
emptying, mailbox removal) notes the message's mailboxes and keywords while
archiving is on, fixing its deadline then; when its data is finally removed
it becomes an x:ArchivedItem record, written as upstream writes them, with
its copy held until the deadline. Retention is read at deletion time, so a
change applies at once. Restore puts a message back in the mailboxes it was
in (Trash only if that was all), with its keywords, and removes the record;
over quota it stays archived. x:ArchivedItem/get returns status and
accountId; query filters on type, archivedAt and text; set requests a
restore once or destroys; /changes is a fork addition. Expired items go in
the data purge. The shared account-access rule moves to jmap::inbuxa::access.
system_tests now calls undelete::test, and the archiving gate is gone.

Cargo.lock

@@ -3896,6 +3896,7 @@ dependencies = [
  "directory",
  "email",
  "imap_proto",
+ "inbuxa-features",
  "mail-parser",
  "md5",
  "nlp",
@@ -3964,6 +3965,8 @@ dependencies = [
  "ahash",
  "jmap_proto",
  "registry",
+ "serde",
+ "serde_json",
  "store",
  "tokio",
  "trc",