fix: keep push notifications working when a mailbox is shared with you

Stalwart refuses a push subscription's whole emailPush map as a
`forbidden` SetError when it names a mailbox shared by ACL (0.16.16 and
later, and 1.0), and 1.0 stops listing emailpush on such accounts. The
app narrowed the map on any `forbidden`, including a refused method
call, and put every account with folders in the first attempt, so 1.0
cost one refused call per install. Worse, a failed listing counted as
"the server has no subscription" and dropped the key of a working
registration, and any failed refresh - a network error, a timeout, rate
limiting - started a replacement.

- `jmap-result` gains `JMAPSetError` (a `JMAPMethodError` with the same
  name, carrying `properties`) and `isJMAPSetError`. `assertSetResult`
  throws it, so every refused object can be told apart from a refused
  call; existing `instanceof` checks and the outbox's name-based error
  classification are unchanged.
- The emailPush map holds the primary account and the accounts whose
  `accountCapabilities` list `urn:ietf:params:jmap:emailpush`, which
  leaves ACL shares out up front on 1.0. On 0.16.16-0.16.23 the refused
  map still narrows to the accounts that look owned, then to the
  primary account, but only on a `forbidden` SetError.
- A subscription ends only with a verified replacement, a user disable
  or the server's verdict: a failed listing aborts the run, and only a
  SetError on the refresh starts a replacement. Other failures leave
  the subscription and its key alone and the next run tries again.
- `forbidden` and `overQuota` read as plain text in settings and the
  onboarding prompt, and settings says that mailboxes others share
  don't send background notifications. New strings in all 27 languages.

src/api/__tests__/push.test.ts

@@ -21,6 +21,7 @@ import {
   updatePushSubscription,
   verifyPushSubscription,
 } from '../push';
+import { isJMAPSetError } from '../jmap-result';
 
 const mockRequest = jmapClient.request as ReturnType<typeof vi.fn>;
 const mockHasCapability = jmapClient.hasCapability as ReturnType<typeof vi.fn>;
@@ -191,6 +192,51 @@ describe('push operations', () => {
       });
       await expect(updatePushSubscription('s1', { expires: '2026-10-01T00:00:00Z' })).resolves.toBeUndefined();
     });
+
+    // The push setup narrows the emailPush map, or replaces a subscription,
+    // only on the server's verdict about the subscription itself.
+    const rejection = (call: () => Promise<unknown>) => call().then(() => null, (err: unknown) => err);
+
+    it('throws a refused create as a SetError (Stalwart 0.16.16+ and 1.0)', async () => {
+      // As Stalwart answers a map naming a mailbox shared by ACL: no
+      // accountId, state or `created` key (jmap-proto method/set.rs).
+      mockRequest.mockResolvedValue({
+        methodResponses: [['PushSubscription/set', { notCreated: { new: forbidden } }, '0']],
+      });
+      const err = await rejection(() =>
+        createPushSubscription({ deviceClientId: 'd', url: 'https://relay/x', types: ['EmailDelivery'] }));
+      expect(isJMAPSetError(err)).toBe(true);
+      expect(err).toMatchObject({ type: 'forbidden' });
+    });
+
+    it('throws an update of a vanished subscription as a notFound SetError', async () => {
+      mockRequest.mockResolvedValue({
+        methodResponses: [['PushSubscription/set', { notUpdated: { s1: { type: 'notFound' } } }, '0']],
+      });
+      const err = await rejection(() => updatePushSubscription('s1', { expires: '2026-10-01T00:00:00Z' }));
+      expect(isJMAPSetError(err)).toBe(true);
+      expect(err).toMatchObject({ type: 'notFound' });
+    });
+
+    it('throws a refused method call as a plain method error, even when forbidden', async () => {
+      mockRequest.mockResolvedValue({
+        methodResponses: [['error', { type: 'forbidden', description: 'Permission denied' }, '0']],
+      });
+      const create = await rejection(() =>
+        createPushSubscription({ deviceClientId: 'd', url: 'https://relay/x', types: ['EmailDelivery'] }));
+      const update = await rejection(() => updatePushSubscription('s1', { expires: '2026-10-01T00:00:00Z' }));
+      for (const err of [create, update]) {
+        expect(err).toMatchObject({ name: 'JMAPMethodError', type: 'forbidden' });
+        expect(isJMAPSetError(err)).toBe(false);
+      }
+    });
+
+    it('does not read an update that is neither applied nor refused as a SetError', async () => {
+      mockRequest.mockResolvedValue({ methodResponses: [['PushSubscription/set', {}, '0']] });
+      const err = await rejection(() => updatePushSubscription('s1', { expires: '2026-10-01T00:00:00Z' }));
+      expect(err).toMatchObject({ name: 'JMAPMethodError' });
+      expect(isJMAPSetError(err)).toBe(false);
+    });
   });
 
   describe('startPolling', () => {