fix(email): explicit TLS mode for non-standard relay ports

The 465-only implicit-TLS heuristic mis-classified Selectel's SSL port (1127),
which the mailer would have dialled with STARTTLS and failed. Add BACKEND_SMTP_TLS
(ssl|starttls) — empty still derives the mode from the port (implicit on 465, else
STARTTLS) — and dial implicit TLS with WithSSL()+WithPort so any port works, not
just 465. Wire SMTP_RELAY_TLS through compose/ci/prod/.env.example and document it
(Selectel: 1127 = SSL, 1126 = STARTTLS). Unit-tested.

deploy/docker-compose.yml

@@ -137,13 +137,16 @@ services:
       # cgroup quota (the runtime otherwise sees all of the host's cores).
       GOMAXPROCS: "2"
       # Transactional email (confirm-codes) via the shared Selectel relay. An empty
-      # host makes the backend log codes instead of sending them (dev default). Port
-      # 465 selects implicit TLS; any other port uses STARTTLS. The From uses the prod
-      # domain (Selectel only accepts the verified sender domain), so it is the same on
-      # every contour. PUBLIC_BASE_URL is the canonical origin for links in the email
-      # (never a request Host header) — required whenever the relay host is set.
+      # host makes the backend log codes instead of sending them (dev default). TLS is
+      # implicit on port 465 and STARTTLS otherwise, unless SMTP_RELAY_TLS forces it
+      # (ssl|starttls) — needed for Selectel's non-standard ports (1127 = SSL, 1126 =
+      # STARTTLS). The From uses the prod domain (Selectel only accepts the verified
+      # sender domain), so it is the same on every contour. PUBLIC_BASE_URL is the
+      # canonical origin for links in the email (never a request Host header) —
+      # required whenever the relay host is set.
       BACKEND_SMTP_HOST: ${SMTP_RELAY_HOST:-}
       BACKEND_SMTP_PORT: ${SMTP_RELAY_PORT:-465}
+      BACKEND_SMTP_TLS: ${SMTP_RELAY_TLS:-}
       BACKEND_SMTP_USERNAME: ${SMTP_RELAY_USER:-}
       BACKEND_SMTP_PASSWORD: ${SMTP_RELAY_PASS:-}
       BACKEND_SMTP_FROM: ${SMTP_RELAY_FROM:-no-reply@localhost}