feat(mail): add governed POP3 legacy import

tests/test_manifest.py

@@ -53,7 +53,22 @@ class MailManifestTests(unittest.TestCase):
         permissions = {permission.scope for permission in manifest.permissions}
         self.assertIn("mail:profile:write_own", permissions)
         self.assertIn("mail:secret:manage_own", permissions)
+        self.assertTrue(
+            {"mail:pop3:manage", "mail:pop3:import", "mail:pop3:delete"}.issubset(
+                permissions
+            )
+        )
         roles = {template.slug: template for template in manifest.role_templates}
+        self.assertIn("mail:pop3:delete", roles["mail_profile_admin"].permissions)
+        self.assertEqual(
+            set(roles["mail_legacy_import_operator"].permissions),
+            {
+                "mail:profile:read",
+                "mail:profile:use",
+                "mail:profile:test",
+                "mail:pop3:import",
+            },
+        )
         self.assertEqual(
             set(roles["mail_profile_self_service"].permissions),
             {
@@ -73,8 +88,27 @@ class MailManifestTests(unittest.TestCase):
                 "mail.reference.credentials-egress-retirement",
                 "mail.reference.campaign-delivery-contract",
                 "mail.address-book-integration",
+                "mail.workflow.legacy-pop3-import",
             }.issubset(topics)
         )
+        pop3_topic = topics["mail.workflow.legacy-pop3-import"]
+        self.assertEqual(("user", "admin"), pop3_topic.documentation_types)
+        self.assertIn("mail:pop3:import", pop3_topic.conditions[0].any_scopes)
+
+        pop3_provider = next(
+            item
+            for item in manifest.external_providers
+            if item.id == "mail.pop3_legacy_import"
+        )
+        self.assertIn("delete", pop3_provider.operations)
+        self.assertTrue(pop3_provider.behavior.outcome_unknown_supported)
+        self.assertIn("mail.pop3.source_deletion", pop3_provider.behavior.audit_event_types)
+        self.assertTrue(
+            any(
+                route.path == "/mail/legacy-import"
+                for route in manifest.frontend.routes  # type: ignore[union-attr]
+            )
+        )
         ownership = topics["mail.profile-ownership-and-consumers"]
         self.assertEqual(ownership.metadata["kind"], "reference")
         self.assertEqual(ownership.metadata["route"], "/settings?section=mail-profiles")