feat(mail): enforce owned profile self-service

src/govoplan_mail/backend/manifest.py

@@ -80,7 +80,17 @@ PERMISSIONS = (
     _permission("mail:profile:test", "Test mail profiles", "Run SMTP/IMAP connection tests."),
     _permission("mail:mailbox:read", "Read mailboxes", "List IMAP folders and inspect messages without mutating mailbox state."),
     _permission("mail:profile:write", "Manage mail profiles", "Create and edit reusable mail profiles."),
+    _permission(
+        "mail:profile:write_own",
+        "Manage own mail profiles",
+        "Create, edit, and deactivate only the current account's user-scoped mail profiles within effective policy.",
+    ),
     _permission("mail:secret:manage", "Manage mail secrets", "Create or replace stored SMTP/IMAP credentials."),
+    _permission(
+        "mail:secret:manage_own",
+        "Manage own mail secrets",
+        "Create, replace, and delete credentials only for the current account's user-scoped mail profiles.",
+    ),
 )
 
 ROLE_TEMPLATES = (
@@ -103,6 +113,19 @@ ROLE_TEMPLATES = (
         description="Use and test approved mail profiles without reading secrets.",
         permissions=("mail:profile:read", "mail:profile:use", "mail:profile:test", "mail:mailbox:read"),
     ),
+    RoleTemplate(
+        slug="mail_profile_self_service",
+        name="Mail profile self-service user",
+        description="Create and manage only personal Mail profiles and credentials within effective policy.",
+        permissions=(
+            "mail:profile:read",
+            "mail:profile:use",
+            "mail:profile:test",
+            "mail:mailbox:read",
+            "mail:profile:write_own",
+            "mail:secret:manage_own",
+        ),
+    ),
 )
 
 
@@ -126,7 +149,7 @@ def _mail_router(context: ModuleContext):
 manifest = ModuleManifest(
     id="mail",
     name="Mail",
-    version="0.1.9",
+    version="0.1.10",
     required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR),
     optional_dependencies=("campaigns", "addresses"),
     provides_interfaces=(
@@ -231,7 +254,12 @@ manifest = ModuleManifest(
             conditions=(
                 DocumentationCondition(
                     required_modules=("mail",),
-                    any_scopes=("mail:profile:read", "mail:profile:use", "mail:profile:write"),
+                    any_scopes=(
+                        "mail:profile:read",
+                        "mail:profile:use",
+                        "mail:profile:write",
+                        "mail:profile:write_own",
+                    ),
                 ),
             ),
             links=(