Masked email: rewrite to the owner at RCPT TO, create responses carry the address, admins query all masks (ME-4, ME-9, ME-13, ME-19)

Found by running system_tests, which masked email no longer stops:
- rcpt_resolve rewrites a live mask to its owner's address, so
  Delivered-To names the account; delivery recognizes the mask from the
  original recipient when it belongs to that account.
- x:MaskedEmail/set create responses carry the server-set email.
- x:MaskedEmail/query returns every mask to a server-level impersonate
  holder, and filters on accountId.
- The refusal for an unlinked emailDomain uses upstream's wording.
- The shared delivery test checks the fork's address format (ME-13).
- The masked email test's tenant domain uses manual DKIM, so its cleanup
  leaves nothing behind.

crates/common/src/network/mta.rs

@@ -72,6 +72,27 @@ impl Server {
             }
         }
 
+        // inbuxa: ME-4, ME-9: a live masked address is rewritten to its
+        // owner's, which keeps the mask as the original recipient
+        if let inbuxa_features::masked_email::ops::Lookup::Accepts(mask) =
+            inbuxa_features::masked_email::ops::lookup(
+                &self.core.storage.data,
+                self.registry(),
+                &format!("{local_part}@{domain_part}"),
+            )
+            .await?
+        {
+            let owner = self.account(mask.object.account_id.document_id()).await?;
+            if let Some(address) = owner.addresses.first()
+                && let Some(owner_domain) = self.domain_by_id(address.domain_id).await?
+                && let Some(owner_domain) = owner_domain.names.first()
+            {
+                return Ok(RcptResolution::Rewrite(format!(
+                    "{}@{}",
+                    address.local_part, owner_domain
+                )));
+            }
+        }
 
         // Obtain external directory, if configured
         let directory = self