feat(vikunja): enable mailer via port-25 in-cluster relay (DEV-563)

Vikunja now sends reminder/notification emails through
`stalwart-smtp.stalwart.svc.cluster.local:25` using unauthenticated
relay from the pod-network CIDR that Stalwart already trusts. The
`vikunja@basicstack.de` principal exists in Stalwart but its password
is unknown and admin API access to reset it is currently broken
(admin/andreas/paperclip password auth returns `{"type":"failure"}` per
`stalwart-oidc-only-admin` note). Verified end-to-end: message from
`vikunja@basicstack.de` sent via port-25 relay arrived in the passbolt
mailbox.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/vikunja/README.md

@@ -28,9 +28,11 @@ Both the app and Postgres pin to Hetzner location `fsn1` because their PVCs live
 - Vikunja does not map OIDC groups to the admin flag. Promote the first user post-login: `kubectl -n vikunja exec deploy/vikunja -- /app/vikunja/vikunja user set-admin --admin <username>`.
 - **PKCE must be OFF on the Pocket ID client.** Vikunja 2.x's OAuth redirect (`frontend/src/helpers/redirectToProvider.ts`) does not send `code_challenge`, and the Go backend does not implement PKCE either. With `pkceEnabled: true` on Pocket ID the flow fails at `/authorize` with `invalid_request … 'code_challenge' parameter is missing`. Client is confidential (`isPublic: false`), so `client_secret` still authenticates the token exchange.
 
-## Optional: SMTP
+## SMTP
 
-`VIKUNJA_MAILER_ENABLED=false` today. To enable reminder emails, create a Stalwart mailbox `vikunja@basicstack.de`, add its credentials as a sealed secret `vikunja-mailer`, and set `VIKUNJA_MAILER_ENABLED=true` plus host/port/from env vars.
+Reminder emails go through Stalwart on `stalwart-smtp.stalwart.svc.cluster.local:25` using unauthenticated in-cluster relay. Stalwart's port-25 listener trusts the pod-network CIDR (`10.244.0.0/16`), so no SMTP AUTH is required and no sealed secret is needed. Envelope-from is `vikunja@basicstack.de` (the mailbox already exists in Stalwart as principal `g`).
+
+If a future policy tightens the port-25 CIDR trust, switch to submission on `stalwart-smtp:587` with STARTTLS and a `vikunja-mailer` sealed secret (`VIKUNJA_MAILER_USERNAME`/`VIKUNJA_MAILER_PASSWORD` from a secretKeyRef, `VIKUNJA_MAILER_AUTHTYPE=plain`); creating that secret requires a working Stalwart admin session to (re)set the vikunja principal's password.
 
 ## Change control
 

apps/vikunja/vikunja-deployment.yaml

@@ -100,7 +100,17 @@ spec:
               name: vikunja-oidc-secret
               key: client-secret
         - name: VIKUNJA_MAILER_ENABLED
+          value: "true"
+        - name: VIKUNJA_MAILER_HOST
+          value: stalwart-smtp.stalwart.svc.cluster.local
+        - name: VIKUNJA_MAILER_PORT
+          value: "25"
+        - name: VIKUNJA_MAILER_FORCESSL
           value: "false"
+        - name: VIKUNJA_MAILER_SKIPTLSVERIFY
+          value: "true"
+        - name: VIKUNJA_MAILER_FROMEMAIL
+          value: vikunja@basicstack.de
         resources:
           requests:
             cpu: 100m