Configure the invitation mailbox in the UI, not the environment

Putting IMAP settings in environment variables was my call to make and it was
the wrong one: it meant editing a file on the server and restarting to change a
folder name, and it was never offered as a choice.

The mailbox is now a row in mailbox_accounts, edited under Settings → Admin:
host, user, password, port, folder, interval, on/off. Administrators only — it
is a shared forwarding target, not a per-user account. The password is never
returned by any endpoint, the same as the CalDAV account routes, and leaving
the field empty on edit keeps the stored one so changing a port does not mean
retyping it. The panel shows when the mailbox was last read and what went wrong
if it did, because a mailbox that quietly stopped working looks exactly like
one that has no mail.

Worth stating plainly: the password now lives in the database, in clear text,
like the CalDAV, Google and Home Assistant credentials beside it. Unlike those
three, an IMAP password opens an entire mailbox.

The scheduler job is registered unconditionally now — whether a mailbox exists
can change without a restart, and fetch_invites returns immediately when none
does. test_scheduler knows about it.

Also adds the requests list to the sidebar with accept and decline, 26
translation keys across all ten languages, and tests covering that the password
is never returned, that an edit without one keeps it, and that a disabled
mailbox counts as unconfigured.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/models.py

@@ -418,6 +418,46 @@ class UserEmailAddress(Base):
     user = relationship("User")
 
 
+class MailboxAccount(Base):
+    """The mailbox watched for invitations, configured in the UI.
+
+    One row per instance: this is a shared inbox that invitations are forwarded
+    to, not a per-user account. Administrators manage it.
+
+    The password is stored as given, the same as CalDAVAccount, GoogleAccount
+    and HomeAssistantAccount — IMAP needs the original to log in, so a hash is
+    no use. Worth knowing: unlike those three, this one opens an entire mailbox.
+    No endpoint ever returns it.
+
+    SMTP lives here too so replies to organisers have somewhere to come from.
+    """
+
+    __tablename__ = "mailbox_accounts"
+
+    id = Column(Integer, primary_key=True, index=True)
+    enabled = Column(Boolean, default=True, nullable=False)
+
+    imap_host = Column(String(255), nullable=False)
+    imap_port = Column(Integer, default=993, nullable=False)
+    imap_ssl = Column(Boolean, default=True, nullable=False)
+    imap_user = Column(String(255), nullable=False)
+    imap_password = Column(String(255), nullable=False)
+    imap_folder = Column(String(255), default="INBOX", nullable=False)
+    poll_minutes = Column(Integer, default=5, nullable=False)
+
+    smtp_host = Column(String(255), nullable=True)
+    smtp_port = Column(Integer, default=587, nullable=True)
+    smtp_ssl = Column(Boolean, default=False, nullable=True)
+    smtp_user = Column(String(255), nullable=True)
+    smtp_password = Column(String(255), nullable=True)
+    smtp_from = Column(String(255), nullable=True)
+
+    # Surfaced in the UI so a mailbox that stopped working says so, instead of
+    # invitations quietly never arriving.
+    last_run = Column(DateTime, nullable=True)
+    last_error = Column(Text, nullable=True)
+
+
 class EventInvite(Base):
     """An iTIP invitation (METHOD:REQUEST) that arrived by mail.