fix(stalwart): wire recovery admin + point portal tile at admin UI

- docker-compose: add STALWART_RECOVERY_ADMIN env so the env-file password
  works as a permanent recovery login. Without this, Stalwart prints a
  one-time bootstrap password to the logs and discards it after first setup
- portal: mail tile now links to /admin/ (the real Stalwart admin SPA),
  not /login (which is the OAuth client authorization UI for IMAP/SMTP
  clients like Thunderbird — confusing and unrelated)

The persistent admin (admin@dezky.local) was created via Stalwart's setup
wizard at /admin/init and lives in the stalwart_data volume. Recovery admin
in env is the "I lost the wizard credentials" escape hatch.

apps/portal/pages/index.vue

@@ -31,7 +31,7 @@ const { user, logout } = useOidcAuth()
           <span class="tile-name">Files</span>
           <span class="tile-meta">OCIS · S3-backed storage</span>
         </a>
-        <a href="https://mail.dezky.local" target="_blank" class="tile">
+        <a href="https://mail.dezky.local/admin/" target="_blank" class="tile">
           <span class="tile-name">Mail</span>
           <span class="tile-meta">Stalwart · JMAP/IMAP/SMTP</span>
         </a>