feat(portal): Apple Mail profile download on user rows + drawer

The .mobileconfig button only lived on the transient credential dialogs
(invite/create/reset results) — nowhere to fetch a profile for an
existing mailbox. Row kebab menu gains 'Download Apple Mail profile'
(mailbox users only) and the user drawer shows the button next to the
mailbox address.

apps/portal/pages/admin/users.vue

@@ -173,6 +173,7 @@ function bulkExport() {
 function rowAction(u: TenantUserDoc, id: string) {
   if (id === 'open') openUser.value = u
   else if (id === 'reset') resetTarget.value = u
+  else if (id === 'apple-profile' && u.mailboxAddress) downloadAppleProfile(u.mailboxAddress, u.name)
   else if (id === 'force') forceLogoutUser(u)
   else if (id === 'make-owner') makeOwnerTarget.value = u
   else if (id === 'suspend') suspendTarget.value = u
@@ -187,6 +188,9 @@ function rowItems(u: TenantUserDoc) {
   return [
     { id: 'open',  label: 'Open profile',        icon: 'external' as const },
     { id: 'reset', label: 'Send password reset', icon: 'key' as const },
+    ...(u.mailboxAddress
+      ? [{ id: 'apple-profile', label: 'Download Apple Mail profile', icon: 'download' as const }]
+      : []),
     { id: 'force', label: 'Force logout',        icon: 'logout' as const },
     { id: 'sep1',  separator: true },
     ...(canManageOwnership.value && effectiveRole(u) !== 'owner'
@@ -743,7 +747,13 @@ async function submitCreateMailbox() {
               <div class="kv">
                 <span class="kv-k">Mailbox</span>
                 <template v-if="openUser.mailboxAddress">
+                  <div class="kv-inline">
                     <Mono class="kv-v">{{ openUser.mailboxAddress }}</Mono>
+                    <UiButton size="sm" variant="secondary" @click="downloadAppleProfile(openUser.mailboxAddress, openUser.name)">
+                      <template #leading><UiIcon name="download" :size="13" /></template>
+                      Apple Mail profile
+                    </UiButton>
+                  </div>
                 </template>
                 <div v-else class="kv-inline">
                   <span class="kv-v muted-v">No mailbox — sign-in only</span>