feat(platform): real email domains, mailboxes & member lifecycle

Wire the mail/identity stack to real Stalwart/Authentik/OCIS provisioning,
replacing the mocked Domains and Users pages.

Domains (customer-admin):
- StalwartClient: real JMAP management (v0.16 dropped REST) — create/list/delete
  email domains via x:Domain at the internal http://stalwart:8080 listener;
  DKIM auto-generated; the records to publish are read from the domain's
  dnsZoneFile. Gated by STALWART_PROVISIONING_ENABLED.
- New Domain collection + DomainsModule: add/list/recheck/set-DMARC/remove,
  tenant-membership-gated and audited.
- DnsVerifierService: verifies MX/SPF/DKIM/DMARC/ownership against a public
  resolver (1.1.1.1/8.8.8.8) and diffs them against the expected records.
- Remove is guarded: refuses while accounts/aliases/mailing lists still use the
  domain (via Stalwart referential integrity).
- Domains page + add wizard on real data; sidebar badge counts domains needing
  attention.

Users & groups (customer-admin):
- Create a member provisioned across Authentik SSO, a Stalwart mailbox on the
  tenant's primary domain, and OCIS — returning a one-time password.
- Lifecycle: suspend/resume (Authentik is_active + freeze the mailbox via
  account permissions, original password preserved), force-logout (terminate
  sessions, filtered client-side so it can never end other users' sessions),
  reset password (new one-time password on SSO + mailbox), and remove (tear down
  mailbox + SSO identity + OCIS + doc; mailbox-in-use aware for multi-tenant
  users). Self-suspend / self-force-logout are blocked.

Infra: point platform-api at the internal Stalwart listener; document the new
STALWART_/provisioning vars in .env.example.

infrastructure/docker-compose/docker-compose.yml

@@ -553,9 +553,14 @@ services:
       MONGODB_URI: mongodb://root:${MONGO_ROOT_PASSWORD}@mongo:27017/dezky?authSource=admin
       AUTHENTIK_API_URL: https://auth.dezky.local/api/v3
       AUTHENTIK_API_TOKEN: ${AUTHENTIK_BOOTSTRAP_TOKEN}
-      STALWART_API_URL: https://mail.dezky.local
+      # Internal hostname (NOT https://mail.dezky.local — that's Traefik + a
+      # mkcert cert Node's fetch rejects). Stalwart's HTTP/JMAP listener is :8080.
+      STALWART_API_URL: http://stalwart:8080
       STALWART_ADMIN_USER: admin
       STALWART_ADMIN_PASSWORD: ${STALWART_ADMIN_PASSWORD}
+      # Gates real domain provisioning (x:Domain/set via JMAP). Off → domain
+      # steps record 'skipped' and the Domains page works without a live Stalwart.
+      STALWART_PROVISIONING_ENABLED: ${STALWART_PROVISIONING_ENABLED:-false}
       # HMAC secret Stalwart signs its webhook POSTs with; we verify on
       # /ingest/stalwart/webhook. Both ends read the same env var.
       STALWART_WEBHOOK_SECRET: ${STALWART_WEBHOOK_SECRET}