Enable Mail trust and verified email checks (#693)

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 7e32c2c7..f8ca8888 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -33,6 +33,7 @@ const CHAT_NAMESPACES = ['chat.preferences', 'chat.tts_defaults', 'chat.dm_setti
  const DEFAULT_GRANTS = [
      // Mail relay checks one address at a time before forwarding; older Contracts pins omit this new capability.
      ...(capabilities.get(EMAIL_READ_CAPABILITY) ? [['mail', EMAIL_READ_CAPABILITY, SELF_AUDIENCE, []]] : []),
++    ['mail', 'identity.trust.read', SELF_AUDIENCE, []],
      // Locker v1 stores private ciphertext in its own Media tenant. Network remains the key directory.
      ...['media.object.upload', 'media.object.read', 'media.object.delete'].map((cap) => ['locker', cap, 'openvibe.media', ['locker']]),
      ['locker', 'identity.subject.resolve', SELF_AUDIENCE, []],
ddiff --git a/test/mail-person-grants.test.js b/test/mail-person-grants.test.js
nnew file mode 100644
iindex 00000000..bba33f2e
---- /dev/null
++++ b/test/mail-person-grants.test.js
@@@ -0,0 +1,14 @@
++'use strict';
++
++const test = require('node:test');
++const assert = require('node:assert/strict');
++const { capabilities } = require('openvibe-contracts');
++const { DEFAULT_GRANTS, SELF_AUDIENCE } = require('../server/identity/principals');
++
++test('Mail can read trust and check only the owner of a verified account email', () => {
++    for (const cap of ['identity.trust.read', 'identity.emails.read']) {
++        assert.ok(capabilities.get(cap), `${cap} must be defined by the pinned Contracts release`);
++        assert.deepEqual(DEFAULT_GRANTS.find(([client, name, audience]) => client === 'mail' && name === cap && audience === SELF_AUDIENCE),
++            ['mail', cap, SELF_AUDIENCE, []]);
++    }
++});