feat(deploy): wire the SMTP relay through every contour

Add the backend confirm-code relay env to compose (BACKEND_SMTP_HOST/PORT/
USERNAME/PASSWORD/FROM + BACKEND_PUBLIC_BASE_URL), sourced from SMTP_RELAY_* /
SMTP_RELAY_FROM / PUBLIC_BASE_URL. An empty host keeps the backend on the log
mailer so a contour without relay credentials still boots. Port defaults to 465
(implicit TLS). Map the TEST_ set in ci.yaml and the PROD_ set in prod-deploy.yaml
(both the deploy-main env and the env.sh heredoc). Document the six variables in
.env.example and the deploy README (secrets: user/pass; variables: host/port/from
+ the per-contour PUBLIC_BASE_URL, required whenever the relay host is set).

deploy/.env.example

@@ -26,6 +26,21 @@ LOG_LEVEL=info
 # real contour value with `openssl rand -base64 32` (Gitea TEST_/PROD_EXPORT_SIGN_KEY).
 EXPORT_SIGN_KEY=dev-export-sign-key
 
+# --- Transactional email (Selectel relay) -----------------------------------
+# Confirm-code email via the shared Selectel relay (one relay for every contour;
+# limit 100 msgs / 5 min). Empty SMTP_RELAY_HOST makes the backend log codes instead
+# of sending (dev). Port 465 = implicit TLS, else STARTTLS; no client cert is needed.
+# FROM must use the prod domain (Selectel only accepts the verified sender domain), so
+# it is the same on every contour. PUBLIC_BASE_URL is the canonical https origin for
+# links in the email — the contour's own public URL. Gitea TEST_/PROD_SMTP_RELAY_* +
+# TEST_/PROD_PUBLIC_BASE_URL.
+SMTP_RELAY_HOST=
+SMTP_RELAY_PORT=465
+SMTP_RELAY_USER=                       # secret
+SMTP_RELAY_PASS=                       # secret
+SMTP_RELAY_FROM=no-reply@erudit-game.ru
+PUBLIC_BASE_URL=                       # required when SMTP_RELAY_HOST is set (e.g. https://erudit-game.ru)
+
 # --- Edge / caddy -----------------------------------------------------------
 # Test: ":80" (the host caddy terminates TLS and forwards to scrabble:80 on the
 # external `edge` network). Prod: a domain so caddy does its own ACME.