fix(email): explicit TLS mode for non-standard relay ports

The 465-only implicit-TLS heuristic mis-classified Selectel's SSL port (1127),
which the mailer would have dialled with STARTTLS and failed. Add BACKEND_SMTP_TLS
(ssl|starttls) — empty still derives the mode from the port (implicit on 465, else
STARTTLS) — and dial implicit TLS with WithSSL()+WithPort so any port works, not
just 465. Wire SMTP_RELAY_TLS through compose/ci/prod/.env.example and document it
(Selectel: 1127 = SSL, 1126 = STARTTLS). Unit-tested.

.gitea/workflows/ci.yaml

@@ -338,6 +338,7 @@ jobs:
           SMTP_RELAY_PASS: ${{ secrets.TEST_SMTP_RELAY_PASS }}
           SMTP_RELAY_HOST: ${{ vars.TEST_SMTP_RELAY_HOST }}
           SMTP_RELAY_PORT: ${{ vars.TEST_SMTP_RELAY_PORT }}
+          SMTP_RELAY_TLS: ${{ vars.TEST_SMTP_RELAY_TLS }}
           SMTP_RELAY_FROM: ${{ vars.TEST_SMTP_RELAY_FROM }}
           # Canonical public origin for links in the email (this contour's URL);
           # required by the backend whenever SMTP_RELAY_HOST is set.