docs: surface custom Mail profile task

docs/MAIL_HANDBOOK.md

@@ -114,6 +114,10 @@ non-production provider and mailbox first. A successful connection test does
 not prove policy authorization for a later Campaign context, deliverability,
 recipient acceptance, SPF/DKIM/DMARC alignment, or future availability.
 
+Testing a saved profile requires both `mail:profile:test` and
+`mail:profile:use`, and the profile must be active. Profile creation or test
+authority alone is not enough.
+
 Raw settings test endpoints accept new settings only for actors who may both
 test profiles and manage secrets. They are an administration aid, not a way for
 ordinary consumers to bypass reusable profiles.
@@ -149,6 +153,14 @@ profile metadata administrators not to know or replace credentials.
 
 ### Create or change a profile
 
+The configured Help Center exposes **Create a custom Mail profile** only when
+the current actor has profile-write authority and the effective user-scope
+policy permits user profiles. It states the active SMTP/IMAP hostname
+allow-list groups and deny rules, plus the actor's separate credential, test,
+use, and approval requirements. The Settings task creates in the current
+account's user scope; `mail:profile:write` itself remains broad profile
+administration authority, not an API-enforced self-only permission.
+
 1. Choose the narrowest suitable scope and a stable, descriptive name/slug.
 2. Configure SMTP, optional IMAP, TLS mode, account identity, Sent-folder
    behavior, and timeouts. Sender/envelope/recipient constraints belong to