fix: keep push notifications working when a mailbox is shared with you

Stalwart refuses a push subscription's whole emailPush map as a
`forbidden` SetError when it names a mailbox shared by ACL (0.16.16 and
later, and 1.0), and 1.0 stops listing emailpush on such accounts. The
app narrowed the map on any `forbidden`, including a refused method
call, and put every account with folders in the first attempt, so 1.0
cost one refused call per install. Worse, a failed listing counted as
"the server has no subscription" and dropped the key of a working
registration, and any failed refresh - a network error, a timeout, rate
limiting - started a replacement.

- `jmap-result` gains `JMAPSetError` (a `JMAPMethodError` with the same
  name, carrying `properties`) and `isJMAPSetError`. `assertSetResult`
  throws it, so every refused object can be told apart from a refused
  call; existing `instanceof` checks and the outbox's name-based error
  classification are unchanged.
- The emailPush map holds the primary account and the accounts whose
  `accountCapabilities` list `urn:ietf:params:jmap:emailpush`, which
  leaves ACL shares out up front on 1.0. On 0.16.16-0.16.23 the refused
  map still narrows to the accounts that look owned, then to the
  primary account, but only on a `forbidden` SetError.
- A subscription ends only with a verified replacement, a user disable
  or the server's verdict: a failed listing aborts the run, and only a
  SetError on the refresh starts a replacement. Other failures leave
  the subscription and its key alone and the next run tries again.
- `forbidden` and `overQuota` read as plain text in settings and the
  onboarding prompt, and settings says that mailboxes others share
  don't send background notifications. New strings in all 27 languages.

src/api/push.ts

@@ -20,6 +20,11 @@ function pushUsing(withEmailPush: boolean): string[] {
   return withEmailPush ? [CAPABILITIES.CORE, CAPABILITIES.EMAIL_PUSH] : [CAPABILITIES.CORE];
 }
 
+/**
+ * Every PushSubscription of the account. Throws when the server can't be
+ * asked or refuses the call - never an empty list instead: to the push setup
+ * an empty list means "the server no longer has our subscription".
+ */
 export async function listPushSubscriptions(): Promise<PushSubscription[]> {
   const withEmailPush = hasEmailPushCapability();
   // `emailPush` is not in the server's default property set, so ask for it
@@ -41,9 +46,9 @@ export async function listPushSubscriptions(): Promise<PushSubscription[]> {
  * Create a PushSubscription pointing the JMAP server at the given relay URL.
  * Returns the server-assigned id (which the client also registers with the
  * relay so the relay can route incoming pushes to an Expo token) and the
- * expiry the server settled on. A refusal throws a JMAPMethodError carrying
- * the server's SetError type, so callers can tell a `forbidden` emailPush map
- * from other failures.
+ * expiry the server settled on. A refused subscription throws a JMAPSetError
+ * carrying the SetError type, so callers can tell a `forbidden` emailPush map
+ * from a refused method call and other failures.
  */
 export async function createPushSubscription(params: {
   deviceClientId: string;
@@ -88,10 +93,11 @@ export async function createPushSubscription(params: {
 
 /**
  * Push the subscription's expiry forward and re-sync its types or delivery
- * filter (RFC 8620 §7.2.1). Throws a JMAPMethodError carrying the server's
- * SetError type when it refuses the update - `notFound` once the
- * subscription is gone, `forbidden` for an emailPush map naming an account
- * the user may not subscribe to.
+ * filter (RFC 8620 §7.2.1). Throws a JMAPSetError carrying the SetError type
+ * when the server refuses the update - `notFound` once the subscription is
+ * gone, `forbidden` for an emailPush map naming an account the user may not
+ * subscribe to. An answer that neither updates nor refuses it is a plain
+ * JMAPMethodError: it says nothing about the subscription.
  */
 export async function updatePushSubscription(
   id: string,