Dovecot 2.4 (now in nixpkgs) removed services.dovecot2.extraConfig and
mailPlugins. Translate the plugin/namespace blocks into the structured
settings tree, hoist ACL plugin keys to top-level (no more `plugin {}`
section), and update the variable-substitution syntax (%n -> %{user |
username}, %u -> %{user}).

Also drop the explicit master ref on nixos-mailserver since the project
no longer uses that branch name as default tracking.

claude is already provided via tools.s (and the default tools include
s now), so drop the explicit claude entry and add s for direct access.

Use the new wrapper plugins option to install the GouvernAI plugin from
GitHub, providing the /guardrails command and gouvernai flow-state skill.

Allow declaratively adding extra Claude Code plugin directories alongside
the bundled one. Each entry becomes a repeatable --plugin-dir flag.

Add MegolmEvent callback that warns the user when a message can't be
decrypted and requests the missing room key. Also process invited_rooms
from the initial sync so invites that arrived while the bot was offline
are accepted instead of being silently ignored.