Masked email: rewrite to the owner at RCPT TO, create responses carry the address, admins query all masks (ME-4, ME-9, ME-13, ME-19)

Found by running system_tests, which masked email no longer stops:
- rcpt_resolve rewrites a live mask to its owner's address, so
  Delivered-To names the account; delivery recognizes the mask from the
  original recipient when it belongs to that account.
- x:MaskedEmail/set create responses carry the server-set email.
- x:MaskedEmail/query returns every mask to a server-level impersonate
  holder, and filters on accountId.
- The refusal for an unlinked emailDomain uses upstream's wording.
- The shared delivery test checks the fork's address format (ME-13).
- The masked email test's tenant domain uses manual DKIM, so its cleanup
  leaves nothing behind.

tests/src/system/delivery.rs

@@ -216,8 +216,11 @@ pub async fn test(test: &mut TestServer) {
     let masked = response.created(0);
     let masked_random_id = masked.object_id();
     let masked_random_email = masked.text_field("email").to_string();
+    // inbuxa: ME-13: the fork's addresses never contain a '.' in the local
+    // part, so they can't be mistaken for upstream's
     assert!(
-        masked_random_email.contains(".") && masked_random_email.ends_with("@example.org"),
+        !masked_random_email.split('@').next().unwrap().contains('.')
+            && masked_random_email.ends_with("@example.org"),
         "Unexpected masked email: {masked_random_email}"
     );
 

tests/src/system/masked_email.rs

@@ -107,6 +107,12 @@ pub async fn test(test: &mut TestServer) {
         pending_email,
         "ME-9"
     );
+    // ... and Delivered-To stays the account's real address (observed 3)
+    assert_eq!(
+        alice.latest_header("Delivered-To").await.trim(),
+        "[email protected]",
+        "ME-9: Delivered-To"
+    );
 
     // ME-10: sub-addressing on a mask
     let (local, domain) = pending_email.split_once('@').unwrap();
@@ -259,6 +265,9 @@ pub async fn test(test: &mut TestServer) {
             name: "mask-tenant.example.org".to_string(),
             is_enabled: true,
             member_tenant_id: Some(t_id),
+            certificate_management: registry::schema::structs::CertificateManagement::Manual,
+            dns_management: registry::schema::structs::DnsManagement::Manual,
+            dkim_management: registry::schema::structs::DkimManagement::Manual,
             ..Default::default()
         })
         .await;
@@ -385,8 +394,14 @@ pub async fn test(test: &mut TestServer) {
         admin.destroy_account(account).await;
     }
     test.wait_for_tasks().await;
-    admin.registry_destroy(ObjectType::Domain, [t_domain]).await;
-    admin.registry_destroy(ObjectType::Tenant, [t_id]).await;
+    admin
+        .registry_destroy(ObjectType::Domain, [t_domain])
+        .await
+        .assert_destroyed(&[t_domain]);
+    admin
+        .registry_destroy(ObjectType::Tenant, [t_id])
+        .await
+        .assert_destroyed(&[t_id]);
 }
 
 /// Acceptance test 12 (compat): masks written before the cutover resolve by