Несколько ящиков у одного логина, общие ящики, кто ответил, вход ящик*логин

- V7: users.is_shared, mailbox_access (MEMBER от админа/Jambotron, ATTACHED по паролю ящика), messages.answered_by
- /api/mailboxes: мои ящики с непрочитанными, сессия другого ящика (JWT с claim by), подключить по паролю
  (LoginGuard), убрать из меню
- общий ящик: без своего входа (веб/SMTP/IMAP), участники открывают; «прочитано» общее; ответ из веба → answered_by
- SMTP/IMAP: ящик*логин + пароль логина (как master user в Dovecot)
- открытый чужой ящик (общий, подключённый, OPEN админа): профиль и пароль не меняются (403)
- админ: создать shared, участники ящика (PUT /{id}/members); служебное API: PUT /shared/{address};
  выключение аккаунта убирает и из общих ящиков
- UI: MAILBOXES в левом меню (переключение, ⊕ подключить, × убрать), shared/участники в настройках,
  «Answered by» у письма
- 88 тестов; живой прогон на Postgres 17 (апгрейд V6→V7 на данных), скриншоты UI

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/src/main/java/com/mailserver/controller/MailboxAdminController.java

@@ -6,6 +6,7 @@ import com.mailserver.domain.User;
 import com.mailserver.dto.LoginResponse;
 import com.mailserver.service.MailDirectory;
 import com.mailserver.service.MailLists;
+import com.mailserver.service.MailboxAccess;
 import com.mailserver.service.MailService;
 import com.mailserver.service.UserService;
 import com.mailserver.util.JwtUtils;
@@ -45,12 +46,13 @@ public class MailboxAdminController {
     private static final int MIN_PASSWORD = MailDirectory.MIN_PASSWORD;
 
     public record MailboxView(Long id, String email, String displayName, boolean active, boolean admin, boolean trap,
-                              long usedBytes, long quotaBytes, Instant createdAt) {
+                              boolean shared, List<String> members, long usedBytes, long quotaBytes, Instant createdAt) {
     }
 
     /** @param password empty — the server generates one and returns it once */
+    /** @param shared shared mailbox (support@): no login of its own — members open it; password ignored */
     public record CreateRequest(@NotBlank @Size(max = 254) String email, @Size(max = 100) String displayName,
-                                @Size(max = 200) String password) {
+                                @Size(max = 200) String password, Boolean shared) {
     }
 
     public record PasswordRequest(@Size(max = 200) String password) {
@@ -73,9 +75,11 @@ public class MailboxAdminController {
     private final JwtUtils jwt;
     private final MailDirectory directory;
     private final MailLists lists;
+    private final MailboxAccess access;
 
     public MailboxAdminController(UserService users, MailService mail, MailDomains domains, MailAdmins admins, JwtUtils jwt,
-                                  MailDirectory directory, MailLists lists) {
+                                  MailDirectory directory, MailLists lists, MailboxAccess access) {
+        this.access = access;
         this.jwt = jwt;
         this.directory = directory;
         this.lists = lists;
@@ -100,11 +104,13 @@ public class MailboxAdminController {
             if (!chosen.isEmpty() && chosen.length() < MIN_PASSWORD) {
                 return Mono.error(bad("Password: at least " + MIN_PASSWORD + " characters, or leave it empty to generate one"));
             }
-            String password = chosen.isEmpty() ? randomPassword() : chosen;
+            boolean shared = Boolean.TRUE.equals(request.shared());
+            String password = chosen.isEmpty() || shared ? randomPassword() : chosen;
             return directory.createMailbox(request.email(), request.displayName(), password)
-                    .doOnNext(user -> log.info("Mailbox created by administrator: {}", user.getEmail()))
+                    .flatMap(user -> shared ? users.setShared(user, true) : Mono.just(user))
+                    .doOnNext(user -> log.info("{} created by administrator: {}", shared ? "Shared mailbox" : "Mailbox", user.getEmail()))
                     .flatMap(this::view)
-                    .map(view -> new Created(view, chosen.isEmpty() ? password : null));
+                    .map(view -> new Created(view, chosen.isEmpty() && !shared ? password : null));
         });
     }
 
@@ -134,7 +140,7 @@ public class MailboxAdminController {
         return admin(auth).flatMap(me -> mailbox(id).map(user -> {
             log.warn("Administrator {} opened mailbox {}", me, user.getEmail());
             LoginResponse response = new LoginResponse();
-            response.setToken(jwt.generateToken(user.getEmail()));
+            response.setToken(jwt.generateToken(user.getEmail(), me));
             response.setEmail(user.getEmail());
             return response;
         }));
@@ -161,6 +167,19 @@ public class MailboxAdminController {
         }))).flatMap(this::view);
     }
 
+    public record MembersRequest(List<String> members) {
+    }
+
+    /** Exactly these members may open the mailbox (shared mailbox; for an ordinary one — delegates). */
+    @PutMapping("/{id}/members")
+    public Mono<MailboxView> members(Mono<Authentication> auth, @PathVariable Long id, @RequestBody Mono<MembersRequest> body) {
+        return admin(auth).flatMap(me -> body.flatMap(request -> mailbox(id).flatMap(user ->
+                directory.setMembers(user, request.members())
+                        .doOnSuccess(v -> log.info("Members of {} set by administrator {}: {}", user.getEmail(), me, request.members()))
+                        .then(users.byId(id)))))
+                .flatMap(this::view);
+    }
+
     // --- Mailing lists (Settings → LISTS) ---
 
     public record ListRequest(@Size(max = 50) String folder, @Size(max = 255) String description, boolean openToOutside,
@@ -202,9 +221,9 @@ public class MailboxAdminController {
     }
 
     private Mono<MailboxView> view(User user) {
-        return mail.usedBytes(user.getId()).defaultIfEmpty(0L)
-                .map(used -> new MailboxView(user.getId(), user.getEmail(), user.getDisplayName(), user.isActive(),
-                        admins.isAdmin(user.getEmail()), user.isTrap(), used, user.getQuotaBytes() == null ? 0 : user.getQuotaBytes(),
+        return mail.usedBytes(user.getId()).defaultIfEmpty(0L).zipWith(access.members(user.getId()).collectList())
+                .map(pair -> new MailboxView(user.getId(), user.getEmail(), user.getDisplayName(), user.isActive(),
+                        admins.isAdmin(user.getEmail()), user.isTrap(), user.isShared(), pair.getT2(), pair.getT1(), user.getQuotaBytes() == null ? 0 : user.getQuotaBytes(),
                         user.getCreatedAt()));
     }