feat(deploy): wire the SMTP relay through every contour

Add the backend confirm-code relay env to compose (BACKEND_SMTP_HOST/PORT/
USERNAME/PASSWORD/FROM + BACKEND_PUBLIC_BASE_URL), sourced from SMTP_RELAY_* /
SMTP_RELAY_FROM / PUBLIC_BASE_URL. An empty host keeps the backend on the log
mailer so a contour without relay credentials still boots. Port defaults to 465
(implicit TLS). Map the TEST_ set in ci.yaml and the PROD_ set in prod-deploy.yaml
(both the deploy-main env and the env.sh heredoc). Document the six variables in
.env.example and the deploy README (secrets: user/pass; variables: host/port/from
+ the per-contour PUBLIC_BASE_URL, required whenever the relay host is set).

deploy/docker-compose.yml

@@ -136,6 +136,18 @@ services:
       # GOMAXPROCS matches the CPU limit below so the Go scheduler aligns with the
       # cgroup quota (the runtime otherwise sees all of the host's cores).
       GOMAXPROCS: "2"
+      # Transactional email (confirm-codes) via the shared Selectel relay. An empty
+      # host makes the backend log codes instead of sending them (dev default). Port
+      # 465 selects implicit TLS; any other port uses STARTTLS. The From uses the prod
+      # domain (Selectel only accepts the verified sender domain), so it is the same on
+      # every contour. PUBLIC_BASE_URL is the canonical origin for links in the email
+      # (never a request Host header) — required whenever the relay host is set.
+      BACKEND_SMTP_HOST: ${SMTP_RELAY_HOST:-}
+      BACKEND_SMTP_PORT: ${SMTP_RELAY_PORT:-465}
+      BACKEND_SMTP_USERNAME: ${SMTP_RELAY_USER:-}
+      BACKEND_SMTP_PASSWORD: ${SMTP_RELAY_PASS:-}
+      BACKEND_SMTP_FROM: ${SMTP_RELAY_FROM:-no-reply@localhost}
+      BACKEND_PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-}
     # The dictionary lives on a named volume seeded from the image on first boot
     # (the image's /opt/dawg is owned by the nonroot UID, which the fresh volume
     # inherits). The admin console writes new version subdirectories here, and the