fix(email): explicit TLS mode for non-standard relay ports

The 465-only implicit-TLS heuristic mis-classified Selectel's SSL port (1127),
which the mailer would have dialled with STARTTLS and failed. Add BACKEND_SMTP_TLS
(ssl|starttls) — empty still derives the mode from the port (implicit on 465, else
STARTTLS) — and dial implicit TLS with WithSSL()+WithPort so any port works, not
just 465. Wire SMTP_RELAY_TLS through compose/ci/prod/.env.example and document it
(Selectel: 1127 = SSL, 1126 = STARTTLS). Unit-tested.

.gitea/workflows/prod-deploy.yaml

@@ -91,6 +91,7 @@ jobs:
       SMTP_RELAY_PASS: ${{ secrets.PROD_SMTP_RELAY_PASS }}
       SMTP_RELAY_HOST: ${{ vars.PROD_SMTP_RELAY_HOST }}
       SMTP_RELAY_PORT: ${{ vars.PROD_SMTP_RELAY_PORT }}
+      SMTP_RELAY_TLS: ${{ vars.PROD_SMTP_RELAY_TLS }}
       SMTP_RELAY_FROM: ${{ vars.PROD_SMTP_RELAY_FROM }}
       PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
       PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
@@ -151,6 +152,7 @@ jobs:
           export EXPORT_SIGN_KEY='$EXPORT_SIGN_KEY'
           export SMTP_RELAY_HOST='$SMTP_RELAY_HOST'
           export SMTP_RELAY_PORT='$SMTP_RELAY_PORT'
+          export SMTP_RELAY_TLS='$SMTP_RELAY_TLS'
           export SMTP_RELAY_USER='$SMTP_RELAY_USER'
           export SMTP_RELAY_PASS='$SMTP_RELAY_PASS'
           export SMTP_RELAY_FROM='$SMTP_RELAY_FROM'