fix(email): explicit TLS mode for non-standard relay ports

The 465-only implicit-TLS heuristic mis-classified Selectel's SSL port (1127),
which the mailer would have dialled with STARTTLS and failed. Add BACKEND_SMTP_TLS
(ssl|starttls) — empty still derives the mode from the port (implicit on 465, else
STARTTLS) — and dial implicit TLS with WithSSL()+WithPort so any port works, not
just 465. Wire SMTP_RELAY_TLS through compose/ci/prod/.env.example and document it
(Selectel: 1127 = SSL, 1126 = STARTTLS). Unit-tested.

backend/internal/account/mailer.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/wneessen/go-mail"
@@ -31,27 +32,46 @@ type Mailer interface {
 // SMTPConfig configures the SMTP relay. An empty Host selects the LogMailer
 // instead, so a deployment without a relay still runs (the code lands in the log).
 // TLS is always used and no client certificate is required — only the server
-// certificate is validated against the system roots. The Port selects the TLS
-// mode: smtpImplicitTLSPort (465) uses implicit TLS (SSL); any other port uses
-// mandatory STARTTLS.
+// certificate is validated against the system roots.
 type SMTPConfig struct {
 	Host     string
 	Port     string
 	Username string
 	Password string
 	From     string
+	// TLS selects the transport security: "ssl" for implicit TLS from connect, or
+	// "starttls" to upgrade a plaintext connection. Empty derives the mode from the
+	// port (implicit TLS on 465, STARTTLS otherwise); set it explicitly for a relay on
+	// a non-standard port (e.g. Selectel's 1127 = SSL, 1126 = STARTTLS).
+	TLS string
 }
 
 const (
-	// smtpImplicitTLSPort is the port on which the relay is dialled with implicit
-	// TLS (SSL). Any other port negotiates mandatory STARTTLS instead.
-	smtpImplicitTLSPort = 465
+	// SMTP transport-security modes for SMTPConfig.TLS.
+	smtpTLSImplicit = "ssl"
+	smtpTLSSTARTTLS = "starttls"
 	// smtpDialTimeout bounds a single relay connect-and-send. The confirm-code send
 	// is synchronous on the request path, so an unreachable relay must fail fast
 	// rather than hold the request open.
 	smtpDialTimeout = 15 * time.Second
 )
 
+// tlsMode resolves the transport-security mode for the relay: the explicitly
+// configured SMTPConfig.TLS, or — when unset — implicit TLS on the conventional SSL
+// port 465 and STARTTLS on any other port.
+func (cfg SMTPConfig) tlsMode(port int) string {
+	switch strings.ToLower(strings.TrimSpace(cfg.TLS)) {
+	case smtpTLSImplicit, "tls":
+		return smtpTLSImplicit
+	case smtpTLSSTARTTLS:
+		return smtpTLSSTARTTLS
+	}
+	if port == 465 {
+		return smtpTLSImplicit
+	}
+	return smtpTLSSTARTTLS
+}
+
 // SMTPMailer sends mail through an SMTP relay using go-mail. When a username is
 // set it authenticates, auto-discovering the strongest mechanism the relay
 // advertises; otherwise it relays unauthenticated.
@@ -72,11 +92,11 @@ func (m SMTPMailer) Send(ctx context.Context, msg Message) error {
 	if err != nil {
 		return fmt.Errorf("account: invalid SMTP port %q: %w", m.cfg.Port, err)
 	}
-	opts := []mail.Option{mail.WithTimeout(smtpDialTimeout)}
-	if port == smtpImplicitTLSPort {
-		opts = append(opts, mail.WithSSLPort(false))
+	opts := []mail.Option{mail.WithPort(port), mail.WithTimeout(smtpDialTimeout)}
+	if m.cfg.tlsMode(port) == smtpTLSImplicit {
+		opts = append(opts, mail.WithSSL())
 	} else {
-		opts = append(opts, mail.WithPort(port), mail.WithTLSPortPolicy(mail.TLSMandatory))
+		opts = append(opts, mail.WithTLSPortPolicy(mail.TLSMandatory))
 	}
 	if m.cfg.Username != "" {
 		opts = append(opts,