Fix Stalwart HTTP listener access for Traefik ingress

Stalwart was blocking the HTTP port (8080) from Traefik's internal IP
(10.244.2.227), causing 502 errors when accessing mail.basicstack.de.

Changes:
- Added complete Stalwart TOML configuration (stalwart-config.yaml)
- Configured HTTP listener security to allow internal pod network (10.244.0.0/16)
- Updated StatefulSet to use the new configuration file
- This allows Traefik ingress to reach the Stalwart web UI backend

The fix is non-destructive:
- PVC data is preserved
- Rolling update will restart the pod with new config
- Only security setting is changed (adding allowed IPs)

Fixes: DEV-422

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/stalwart/stalwart-config.yaml

@@ -0,0 +1,72 @@
+---
+# Stalwart Mail Server Configuration
+# This ConfigMap provides a complete configuration with security settings
+# that allow internal cluster IPs to access the HTTP listener.
+#
+# The HTTP listener is only accessible via ClusterIP service and Traefik ingress,
+# so allowing the internal pod network (10.244.0.0/16) is safe and necessary.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: stalwart-config
+  namespace: stalwart
+data:
+  stalwart.toml: |
+    #
+    # Stalwart Mail Server Configuration
+    #
+
+    [store]
+    data = "rocksdb"
+
+    [store.rocksdb]
+    type = "rocksdb"
+    path = "/var/lib/stalwart"
+
+    #
+    # Server Configuration
+    #
+
+    [server]
+    hostname = "mail.basicstack.de"
+
+    # HTTP Listener (Web UI and API)
+    [server.listener.http]
+    bind = ["0.0.0.0:8080"]
+    protocol = "http"
+
+    # Security: Allow internal cluster IPs for Traefik ingress
+    # Pod network CIDR: 10.244.0.0/16
+    [server.listener.http.security]
+    allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]
+
+    # SMTP Listener (Port 25)
+    [server.listener.smtp]
+    bind = ["0.0.0.0:25"]
+    protocol = "smtp"
+
+    # Submission Listener (Port 587 with STARTTLS)
+    [server.listener.submission]
+    bind = ["0.0.0.0:587"]
+    protocol = "smtp"
+
+    # IMAPS Listener (Port 993 with TLS)
+    [server.listener.imaps]
+    bind = ["0.0.0.0:993"]
+    protocol = "imap"
+    tls.implicit = true
+
+    #
+    # TLS Configuration
+    #
+
+    [server.tls]
+    certificate = "file:///etc/stalwart/certs/tls.crt"
+    private-key = "file:///etc/stalwart/certs/tls.key"
+
+    #
+    # Logging
+    #
+
+    [tracing.level]
+    default = "info"

apps/stalwart/stalwart-fresh-deployment.yaml

@@ -100,6 +100,8 @@ spec:
       containers:
       - name: stalwart
         image: stalwartlabs/stalwart:v0.16.11
+        command: ["/usr/local/bin/stalwart"]
+        args: ["--config", "/etc/stalwart/stalwart.toml"]
         ports:
         - containerPort: 25
           name: smtp
@@ -125,9 +127,9 @@ spec:
         volumeMounts:
         - name: data
           mountPath: /var/lib/stalwart
-        - name: bootstrap-config
+        - name: stalwart-config
-          mountPath: /etc/stalwart/config.json
+          mountPath: /etc/stalwart/stalwart.toml
-          subPath: config.json
+          subPath: stalwart.toml
         - name: tls-certs
           mountPath: /etc/stalwart/certs
           readOnly: true
@@ -178,9 +180,9 @@ spec:
       - name: data
         persistentVolumeClaim:
           claimName: stalwart-data
-      - name: bootstrap-config
+      - name: stalwart-config
         configMap:
-          name: stalwart-bootstrap-config
+          name: stalwart-config
       - name: tls-certs
         secret:
           secretName: stalwart-tls