add MFA, user web mail portal

internal/webui/render.go

@@ -196,6 +196,12 @@ func (a *App) render(w http.ResponseWriter, r *http.Request, page string, data M
 	}
 	data["flashes"] = popFlashes(w, r)
 	data["health"] = a.checkHealth()
+	// Drives the sidebar hiding Server Settings/Let's Encrypt for scoped admins (see
+	// requireGlobalAdmin, which is the actual enforcement — this only controls the
+	// link's visibility).
+	if u := userFromContext(r); u != nil {
+		data["is_global_admin"] = u.IsGlobalAdmin
+	}
 	// Sidebar badge counts (Domains/Senders/Mailboxes/IPs/DKIM Keys) — computed here,
 	// centrally, so every authenticated page shows them, not just the dashboard (which
 	// used to compute these itself and nowhere else did).