fix(jmap): hide Contacts and Calendars when account lacks capability

[polastre]

Summary

JMAP provides both session (server) and account capabilities. The account capabilities were not being check/respected.

Changes

supportsContacts and supportsCalendars checked the server-wide session capability. An account with jmap-contact-* / dav-card-* revoked still got Contacts, and one with jmap-calendar-* / dav-cal-* revoked still got Calendars, with every action failing on an authorization error.

• gate both on accountCapabilities instead of session capabilities
• shared accounts fall back to the server-wide capability rather than an
  unconditional yes, since accountCapabilities is a subset of it
  and Stalwart doesn't always advertise them per-account
• add capability tests for contacts and calendars
• update the supportsContacts tests, which set capabilities directly

Related issues

Related to #563

Note: 8904d72 which addresses #563 falls back to allowing the capability if it is a shared account/group that doesn't advertise accountCapabilities. Strictly speaking, the server capability should be checked next, and not permitted if the server doesn't provide the capability.

This PR only addresses contacts/calendars and not files, but I can do a follow on to provide the same behavior for file capabilities too.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactor / code quality improvement
• Chore / dependency update / CI change

Checklist

• I have read the Contributing Guide
• My code follows the project's code style and conventions
• I have run npm run typecheck && npm run lint and there are no errors
• The build passes (npm run build)
• I have tested my changes locally
• I have added or updated documentation if needed -- N/A
• I have updated translations (locales/) if my changes affect user-facing text -- N/A
• I have included screenshots or a screen recording for UI changes -- N/A

Screenshots / demo

N/A

Notes for reviewers

See the related issues section