feat: SMTP mail stack and separate server.env deploy

Add mail.php with STARTTLS sending, test scripts, server.env split from
local .env, admin@ postbox docs, DKIM DNS support-ticket notes, and todo 11
for boka relay.

Co-authored-by: Cursor <cursoragent@cursor.com>

public/mail-test.php

@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * One-off SMTP test from the webspace (same path as monitor.php cron).
+ * GET /mail-test.php?token=MONITOR_INGEST_TOKEN
+ * Remove or restrict after verification.
+ */
+
+require_once dirname(__DIR__) . '/private/config/mail.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+$token = $_GET['token'] ?? '';
+$expected = env('MONITOR_INGEST_TOKEN') ?? '';
+
+if ($expected === '' || !hash_equals($expected, $token)) {
+    http_response_code(403);
+    echo json_encode(['ok' => false, 'error' => 'forbidden']);
+    exit;
+}
+
+$to = env('ALERT_EMAIL');
+if (!$to) {
+    http_response_code(500);
+    echo json_encode(['ok' => false, 'error' => 'ALERT_EMAIL not set']);
+    exit;
+}
+
+$domain = env('DOMAIN', '0012.de');
+$subject = "[{$domain}] SMTP test (server) " . gmdate('Y-m-d H:i:s') . ' UTC';
+$body = implode("\n", [
+    '0012.de SMTP test — sent from webspace PHP (cron path)',
+    '',
+    'From header: ' . env('SMTP_FROM'),
+    'SMTP auth: ' . env('SMTP_USER'),
+    '',
+    'If you receive this, server-side mail works.',
+]);
+
+try {
+    sendMail($to, $subject, $body);
+    echo json_encode(['ok' => true, 'to' => $to, 'from' => env('SMTP_FROM')]);
+} catch (Throwable $e) {
+    http_response_code(500);
+    echo json_encode(['ok' => false, 'error' => $e->getMessage()]);
+}