feat: SMTP mail stack and separate server.env deploy

Add mail.php with STARTTLS sending, test scripts, server.env split from
local .env, admin@ postbox docs, DKIM DNS support-ticket notes, and todo 11
for boka relay.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/sync-server-env.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+"""Copy server-relevant keys from local .env to server.env (never deploys .env)."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+
+SERVER_KEYS = [
+    "DOMAIN",
+    "SMTP_HOST",
+    "SMTP_PORT",
+    "SMTP_ENCRYPTION",
+    "SMTP_USER",
+    "SMTP_PASSWORD",
+    "SMTP_FROM",
+    "ALERT_EMAIL",
+    "MONITOR_INGEST_TOKEN",
+    "MONITOR_INGEST_URL",
+    "TELEGRAM_BOT_TOKEN",
+    "TELEGRAM_CHAT_ID",
+]
+
+
+def load_env(path: Path) -> dict[str, str]:
+    env: dict[str, str] = {}
+    for line in path.read_text(encoding="utf-8").splitlines():
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        key, _, value = line.partition("=")
+        env[key.strip()] = value.strip()
+    return env
+
+
+def main() -> None:
+    local = ROOT / ".env"
+    target = ROOT / "server.env"
+
+    if not local.is_file():
+        raise SystemExit(f"Missing {local}")
+
+    src = load_env(local)
+    lines = [
+        "# Generated by scripts/sync-server-env.py — do not commit",
+        "# Deploy: ./scripts/deploy.sh uploads this to private/server.env",
+        "",
+    ]
+
+    for key in SERVER_KEYS:
+        if key in src:
+            lines.append(f"{key}={src[key]}")
+
+    target.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    alert = src.get("ALERT_EMAIL", "?")
+    print(f"Wrote {target.name} (ALERT_EMAIL={alert})")
+
+
+if __name__ == "__main__":
+    main()