fix(deploy): stage blackbox config + derive bare Grafana SMTP from-address

Two contour-deploy failures from PR4: (1) the deploy did not stage deploy/blackbox/, so
blackbox_exporter crash-looped on a missing config mount — add blackbox to the ci.yaml cp
and the prod-deploy tar; (2) Grafana rejects the 'Name <addr>' From form the backend go-mail
accepts and validates it even when SMTP is disabled, crash-looping Grafana — the deploy now
splits SMTP_RELAY_SERVICE_FROM into a bare GF_SMTP_FROM_ADDRESS + GRAFANA_SMTP_FROM_NAME
(handles both display and bare forms). Verified the sed split + compose render.

.gitea/workflows/ci.yaml

@@ -384,8 +384,20 @@ jobs:
           conf="$HOME/.scrabble-deploy"
           rm -rf "$conf"
           mkdir -p "$conf"
-          cp -r caddy otelcol prometheus tempo grafana "$conf"/
+          cp -r caddy otelcol prometheus tempo grafana blackbox "$conf"/
           export SCRABBLE_CONFIG_DIR="$conf"
+          # Grafana's SMTP from_address must be a BARE address (it rejects the "Name" <addr>
+          # form the backend go-mail accepts) and validates it even when SMTP is disabled — a
+          # bad value crash-loops Grafana. Split the display-format SERVICE From into a bare
+          # address + name for Grafana; the backend keeps the full form.
+          svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
+          case "$svc_from" in
+            *"<"*">"*)
+              export GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
+              export GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
+            *)
+              export GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
+          esac
           # Bot-link mTLS material for the test contour: a private CA + gateway/bot
           # leaves (CN=gateway, the service name the bot dials). Prod supplies these
           # from PROD_ secrets instead. Regenerated each deploy; both ends redeploy

.gitea/workflows/prod-deploy.yaml

@@ -140,6 +140,16 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-main
+          # Grafana needs a BARE from-address (it rejects the "Name" <addr> form the backend
+          # accepts, and validates it even when disabled); split the display-format here.
+          svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
+          GRAFANA_SMTP_FROM_NAME=''
+          case "$svc_from" in
+            *"<"*">"*)
+              GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
+              GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
+            *) GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
+          esac
           cat > stage/env.sh <<EOF
           export REGISTRY='$REGISTRY'
           export SCRABBLE_CONFIG_DIR='/opt/scrabble'
@@ -167,6 +177,8 @@ jobs:
           export SMTP_RELAY_ADMIN_FROM='$SMTP_RELAY_ADMIN_FROM'
           export ADMIN_EMAIL='$ADMIN_EMAIL'
           export SMTP_RELAY_SERVICE_FROM='$SMTP_RELAY_SERVICE_FROM'
+          export GRAFANA_SMTP_FROM_ADDRESS='$GRAFANA_SMTP_FROM_ADDRESS'
+          export GRAFANA_SMTP_FROM_NAME='$GRAFANA_SMTP_FROM_NAME'
           export SERVICE_EMAIL='$SERVICE_EMAIL'
           export GRAFANA_SMTP_PORT='$GRAFANA_SMTP_PORT'
           export GF_SMTP_ENABLED='$GF_SMTP_ENABLED'
@@ -183,7 +195,7 @@ jobs:
           ssh_main 'mkdir -p /opt/scrabble/compose'
           tar -C deploy -czf - docker-compose.yml docker-compose.prod.yml prod-deploy.sh \
             | ssh_main 'tar -C /opt/scrabble/compose -xzf -'
-          tar -C deploy -czf - caddy otelcol prometheus tempo grafana \
+          tar -C deploy -czf - caddy otelcol prometheus tempo grafana blackbox \
             | ssh_main 'tar -C /opt/scrabble -xzf -'
           tar -C stage -czf - certs-main \
             | ssh_main 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'