[Feature]: Masked addresses under Settings > Security, as in the webmail #143

Problem / Motivation

The webmail lists the account's masked addresses under Settings > Security since 1.21.1 (bulwarkmail/webmail#1534): create one, copy it, give it a description, turn it off, or delete it. The app has none of this.

The phone is where a masked address is most often wanted: signing up for something in a browser or another app, with no computer at hand. Today that means opening the webmail in the phone's browser.

It also reaches many more servers soon. Stalwart has announced that masked email moves from the Enterprise edition to the Community edition with v1.1.1 (https://stalw.art/blog/masked-email-open-source/).

Proposed Solution

Port the webmail's feature (lib/stalwart/masked-email.ts, components/settings/masked-addresses-section.tsx) as a Masked addresses section at the end of Settings > Security:

• The list, ten to a page: the address, its description, the website it was made for, and Enabled or Disabled.
• Copy puts the address on the clipboard.
• Edit opens the row: change the description, Disable or Enable it (a disabled address rejects new mail), or Delete it for good after a confirm that names the address.
• Create masked address, with an optional website and description.
• Hidden where the server has none: another server, Stalwart Community before 1.1.1, or a sign-in the server gives no account settings (the page already explains that case). The section shows only once the server has answered the first read.
• The webmail's checks on every answer: only this account's addresses, a complete list or none, and a delete whose answer never came is not sent again until the list has been read afresh.

The app asks Stalwart directly (x:MaskedEmail/query, /get, /set with urn:stalwart:jmap), as src/api/account-security.ts does for app passwords. The strings are the webmail's settings.security.masked_addresses keys, in every locale. The PR is #144 (see Status below).

Alternatives Considered

• The webmail in the phone's browser: works, but it is a second sign-in on a small screen for something that takes one tap in the app.
• A password manager that speaks JMAP: Stalwart's post names this for creating addresses while saving a login. That covers creating one, not listing, disabling or deleting them.

Feature Area

Settings

Mockups / Examples

The webmail's section, laid out for a phone: each address is a row with Copy and Edit, and the create form sits under the list.

Additional Context

• Status: draft PR feat: manage masked addresses under Settings > Security, as in the webmail #143 #144. It has now run on a device against a real Stalwart with masked addresses (1.1.0 with an Enterprise licence): create, copy, describe, disable, enable, delete and the quota refusal all behave as described. On Community 1.1.0 the section stays hidden. Stalwart 1.1.1, which brings masked email to the Community edition, is not released yet; the object and the calls are the same. Paging past ten addresses and the other refusals were run against a stand-in, since the default quota is five.
• Not in the first version, as in the webmail: an expiry date and a custom prefix or domain for a new address, which Stalwart's object has (expiresAt, emailPrefix, emailDomain).
• The webmail hides the section on Stalwart Community by the server's "only available in the Enterprise edition" refusal ([Bug]: Masked addresses section says "not allowed" on Stalwart Community Edition webmail#1624). The app does the same, so on 1.1.1 the section appears with no change on either side.

🤖 Generated with Claude Code