Вход через Jambotron (OAuth 2.0 code + PKCE), пароли приложений, системные ящики

- /api/oauth/start → JAMBOTRON_URL/oauth/authorize (client mail, PKCE S256);
  /api/oauth/callback: код меняется на сервере у Jambotron /api/oauth/token
  (Bearer SERVICE_TOKEN) → рабочий ящик сотрудника → сессия, ADMIN Jambotron — ADMIN.
- Вход по паролю в веб — только встроенный администратор (когда вход через Jambotron включён).
- Пароли приложений (V9 app_passwords): User panel → APP PASSWORDS, только SMTP/IMAP.
- Системные ящики (V9 users.is_system): без входа в веб, открывают встроенные
  администраторы, не в USERS; Admin panel → MAILBOXES → кнопка SYSTEM.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/src/test/java/com/mailserver/controller/AuthenticationControllerTest.java

@@ -33,8 +33,9 @@ class AuthenticationControllerTest {
     private final JwtUtils jwt = mock(JwtUtils.class);
     private final LoginGuard guard = new LoginGuard(new LoginGuard.Settings(true, 3, 100, Duration.ofMinutes(15),
             Duration.ofMinutes(15), Duration.ofHours(24), Duration.ofDays(30), Set.of(), Duration.ZERO));
+    private final com.mailserver.config.MailAdmins admins = new com.mailserver.config.MailAdmins("admin@x.test", "", new MailDomains("x.test", ""));
     private final AuthenticationController controller = new AuthenticationController(users, mock(MailService.class), jwt,
-            mock(MailDomains.class), false, guard, mock(com.mailserver.config.MailAdmins.class));
+            mock(MailDomains.class), false, guard, admins, new com.mailserver.config.JambotronSso("", "", "", "mail.x.test"));
 
     private final User alice = new User();
 
@@ -56,6 +57,26 @@ class AuthenticationControllerTest {
         return controller.login(Mono.just(request), http).block();
     }
 
+    // «Sign in with Jambotron» on: the web password only for the built-in administrator
+    @Test
+    void withJambotronSignInOnlyTheBuiltInAdministratorLogsInWithAPassword() {
+        AuthenticationController sso = new AuthenticationController(users, mock(MailService.class), jwt,
+                mock(MailDomains.class), false, guard, admins,
+                new com.mailserver.config.JambotronSso("https://jambotron.test", "tok", "", "mail.x.test"));
+        User admin = new User();
+        admin.setEmail("admin@x.test");
+        when(users.findByEmail("admin@x.test")).thenReturn(Mono.just(admin));
+        when(users.checkPassword(eq(admin), anyString())).thenReturn(true);
+        LoginRequest request = new LoginRequest();
+        request.setEmail("alice@x.test");
+        request.setPassword("secret");
+        MockServerHttpRequest http = MockServerHttpRequest.post("/api/login").remoteAddress(new InetSocketAddress("9.9.9.9", 1)).build();
+        assertThat(sso.login(Mono.just(request), http).block().getBody())
+                .isEqualTo(Map.of("error", "Sign in with Jambotron — the password is only for mail programs"));
+        request.setEmail("admin@x.test");
+        assertThat(sso.login(Mono.just(request), http).block().getStatusCode()).isEqualTo(HttpStatus.OK);
+    }
+
     @Test
     void unknownMailboxAndWrongPasswordLookTheSameAndBothCount() {
         assertThat(login("1.2.3.4", "ghost@x.test", "x").getBody()).isEqualTo(Map.of("error", "Invalid credentials"));