feat(dev-deploy): relay Mailpit to Gmail (Stage 3)

Keep Mailpit as the backend's SMTP submission point and turn on its
relay so OTP/notification mail addressed to the owner reaches a real
Gmail inbox, while everything else stays captured-only.

- mailpit gains --smtp-relay-config + --smtp-relay-matching (default
  non-routable, so an unconfigured stack only captures); relay.conf is
  mounted from a new galaxy-dev-mailpit-config volume
- tools/dev-deploy/mailpit/relay.conf.tmpl + a dev-deploy.yaml step that
  renders it from Gitea secrets (Gmail App Password, never committed)
  and seeds the volume; the GALAXY_DEV_MAIL_RELAY_MATCH var drives the
  relay-matching recipient
- backend SMTP config unchanged (still -> galaxy-mailpit:1025)
- dev-deploy README documents the relay + required secrets/vars

Verified locally: compose config valid; the rendered relay.conf is
accepted by mailpit v1.21.8 (relay + recipient-matching enabled).
Real Gmail delivery is verified at the dev-deploy preview once the
owner sets the secrets.

tools/dev-deploy/docker-compose.yml

@@ -66,10 +66,20 @@ services:
     image: axllent/mailpit:v1.21
     container_name: galaxy-dev-mailpit
     restart: unless-stopped
+    # Mailpit is both the SMTP submission point and a relay: it captures
+    # every message in its UI and auto-relays the ones whose recipient
+    # matches GALAXY_DEV_MAIL_RELAY_MATCH to the Gmail account in the
+    # secret-rendered relay config. The default match is non-routable, so
+    # a stack brought up without the relay secret only captures, never sends.
+    command:
+      - "--smtp-relay-config=/etc/mailpit/relay.conf"
+      - "--smtp-relay-matching=${GALAXY_DEV_MAIL_RELAY_MATCH:-nobody@invalid.example}"
     labels:
       galaxy.stack: dev-deploy
     networks:
       - galaxy-internal
+    volumes:
+      - galaxy-dev-mailpit-config:/etc/mailpit:ro
     healthcheck:
       test: ["CMD", "wget", "-q", "-O-", "http://localhost:8025/livez"]
       interval: 3s
@@ -283,3 +293,5 @@ volumes:
     name: galaxy-dev-site-dist
   galaxy-dev-geoip-data:
     name: galaxy-dev-geoip-data
+  galaxy-dev-mailpit-config:
+    name: galaxy-dev-mailpit-config