fix(email): explicit TLS mode for non-standard relay ports

The 465-only implicit-TLS heuristic mis-classified Selectel's SSL port (1127),
which the mailer would have dialled with STARTTLS and failed. Add BACKEND_SMTP_TLS
(ssl|starttls) — empty still derives the mode from the port (implicit on 465, else
STARTTLS) — and dial implicit TLS with WithSSL()+WithPort so any port works, not
just 465. Wire SMTP_RELAY_TLS through compose/ci/prod/.env.example and document it
(Selectel: 1127 = SSL, 1126 = STARTTLS). Unit-tested.

docs/ARCHITECTURE.md

@@ -233,9 +233,10 @@ arrive from a platform rather than completing a mandatory registration).
   robot opponent (§7). The **email confirm-code flow** binds an email to the
   authenticated account: a 6-digit code (stored only as a SHA-256 hash, 15-minute
   TTL, ≤ 5 attempts) is sent as a **branded HTML + plain-text email** through a
-  `Mailer` seam (go-mail over the shared relay — implicit TLS on port 465 or
-  STARTTLS, the server certificate validated against the system roots, no client
-  certificate; a development log mailer when no relay is configured) and, once
+  `Mailer` seam (go-mail over the shared relay — TLS chosen by port, implicit on
+  465 and STARTTLS otherwise, or forced by config for a non-standard port; the
+  server certificate validated against the system roots, no client certificate; a
+  development log mailer when no relay is configured) and, once
   verified, attaches a confirmed email identity. Sends are throttled per recipient
   (a 60-second cooldown and a five-per-hour cap). Links in the email are built from
   a configured public base URL, never a request Host header (anti-injection). An