Configure the invitation mailbox in the UI, not the environment

Putting IMAP settings in environment variables was my call to make and it was
the wrong one: it meant editing a file on the server and restarting to change a
folder name, and it was never offered as a choice.

The mailbox is now a row in mailbox_accounts, edited under Settings → Admin:
host, user, password, port, folder, interval, on/off. Administrators only — it
is a shared forwarding target, not a per-user account. The password is never
returned by any endpoint, the same as the CalDAV account routes, and leaving
the field empty on edit keeps the stored one so changing a port does not mean
retyping it. The panel shows when the mailbox was last read and what went wrong
if it did, because a mailbox that quietly stopped working looks exactly like
one that has no mail.

Worth stating plainly: the password now lives in the database, in clear text,
like the CalDAV, Google and Home Assistant credentials beside it. Unlike those
three, an IMAP password opens an entire mailbox.

The scheduler job is registered unconditionally now — whether a mailbox exists
can change without a restart, and fetch_invites returns immediately when none
does. test_scheduler knows about it.

Also adds the requests list to the sidebar with accept and decline, 26
translation keys across all ten languages, and tests covering that the password
is never returned, that an edit without one keeps it, and that a disabled
mailbox counts as unconfigured.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -112,12 +112,7 @@ Configuration is done via environment variables. The `install.sh` script generat
 | `SCHEDULER_ENABLED` | `1` | `0` disables all background jobs |
 | `ATTACHMENT_SWEEP_HOURS` | `24` | How often orphaned attachments are cleaned up |
 | `ICAL_REFRESH_MINUTES` | `15` | How often iCal subscriptions are checked in the background |
-| `IMAP_HOST` | — | Mailbox watched for invitations. Unset disables the whole feature *(optional)* |
-| `IMAP_PORT` | `993` | |
-| `IMAP_SSL` | `1` | `0` for a plain connection |
-| `IMAP_USER` / `IMAP_PASSWORD` | — | Mailbox credentials |
-| `IMAP_FOLDER` | `INBOX` | |
-| `MAIL_POLL_MINUTES` | `5` | How often the mailbox is read |
+| `MAIL_POLL_MINUTES` | `5` | How often the watched mailbox is read |
 | `OIDC_PROVIDERS` | — | Comma-separated provider keys, e.g. `authentik` *(optional)* |
 
 Per provider `<KEY>` listed in `OIDC_PROVIDERS` (variable names are uppercased):
@@ -245,7 +240,7 @@ The server runs two periodic jobs in-process:
 |---|---|---|
 | `attachments.sweep` | 24 h | Removes attachment records whose event is gone, and files with no record |
 | `ical.refresh` | 15 min | Re-fetches iCal subscriptions that are due |
-| `mail.invites` | 5 min | Reads the watched mailbox for invitations *(only when `IMAP_HOST` is set)* |
+| `mail.invites` | 5 min | Reads the watched mailbox for invitations *(idle until one is configured)* |
 
 #### Invitations by mail
 
@@ -259,9 +254,12 @@ That matters when mail is forwarded: the invitation still names the original
 address, not the mailbox it arrived in, so put the address people actually
 invite into the user's profile.
 
-Credentials live in the environment rather than the database, so the one secret
-that opens a whole mailbox is never returned by any endpoint. One mailbox per
-instance; a forwarding target is the intended setup.
+The mailbox is set up under **Settings → Invitations** by an administrator: IMAP
+host, user, password, folder and how often to check. One mailbox per instance —
+it is a shared forwarding target, not a per-user account. The password is stored
+the same way CalDAV, Google and Home Assistant credentials are, and no endpoint
+returns it. Worth knowing before you point this at a real account: unlike those
+three, an IMAP password opens an entire mailbox.
 
 Attachments are normally cleaned up the moment an event, calendar or user is
 deleted; the sweep is the safety net for what gets past that — an external