fix(email): explicit TLS mode for non-standard relay ports

The 465-only implicit-TLS heuristic mis-classified Selectel's SSL port (1127),
which the mailer would have dialled with STARTTLS and failed. Add BACKEND_SMTP_TLS
(ssl|starttls) — empty still derives the mode from the port (implicit on 465, else
STARTTLS) — and dial implicit TLS with WithSSL()+WithPort so any port works, not
just 465. Wire SMTP_RELAY_TLS through compose/ci/prod/.env.example and document it
(Selectel: 1127 = SSL, 1126 = STARTTLS). Unit-tested.

deploy/.env.example

@@ -30,12 +30,16 @@ EXPORT_SIGN_KEY=dev-export-sign-key
 # Confirm-code email via the shared Selectel relay (one relay for every contour;
 # limit 100 msgs / 5 min). Empty SMTP_RELAY_HOST makes the backend log codes instead
 # of sending (dev). Port 465 = implicit TLS, else STARTTLS; no client cert is needed.
-# FROM must use the prod domain (Selectel only accepts the verified sender domain), so
-# it is the same on every contour. PUBLIC_BASE_URL is the canonical https origin for
-# links in the email — the contour's own public URL. Gitea TEST_/PROD_SMTP_RELAY_* +
-# TEST_/PROD_PUBLIC_BASE_URL.
+# TLS is implicit on port 465 and STARTTLS otherwise, unless SMTP_RELAY_TLS forces it
+# (ssl|starttls) — required for Selectel's non-standard ports (1127 = SSL, 1126 =
+# STARTTLS). FROM must use the prod domain (Selectel only accepts the verified sender
+# domain), so it is the same on every contour; a display name is fine
+# (`"Игра Эрудит" <no-reply@erudit-game.ru>`). PUBLIC_BASE_URL is the canonical https
+# origin for links in the email — the contour's own public URL. Gitea
+# TEST_/PROD_SMTP_RELAY_* + TEST_/PROD_PUBLIC_BASE_URL.
 SMTP_RELAY_HOST=
 SMTP_RELAY_PORT=465
+SMTP_RELAY_TLS=                        # empty = auto by port; ssl | starttls to force
 SMTP_RELAY_USER=                       # secret
 SMTP_RELAY_PASS=                       # secret
 SMTP_RELAY_FROM=no-reply@erudit-game.ru