feat(mail): Z-Push Exchange ActiveSync gateway for mobile clients

Wraps Stalwart in EAS so iOS/Android native Mail/Calendar 'Exchange'
accounts get two-way mail+calendar+contacts sync (BackendCombined:
IMAP + CalDAV /dav/cal/%l/ + CardDAV, credentials pass through).

- services/zpush: Z-Push 2.6.4 (AGPLv3, see LICENSE-NOTES.md) on
  php:8.2-apache-bookworm (trixie dropped libc-client); PHP 8 sysv
  sprintf fatal sed-patched; autodiscover dispatcher answers
  mobilesync schema, proxies outlook schema to Stalwart unchanged
- prod: zpush Deployment (replicas:1, Recreate — file sync state),
  /Microsoft-Server-ActiveSync Ingress on mail.dezky.eu (no redirect,
  POST-heavy), autodiscover.dezky.eu repointed to the dispatcher,
  selectorless stalwart-imaps/-smtps Services (host-Stalwart is
  implicit-TLS only: 993/465, no plain 143/587 — verified on node1)
- CI: build+deploy zpush like the other apps

EAS tops out at 14.1: covers native mobile clients, NOT the Outlook
mobile app (needs 16.1) and not new Outlook for Windows (no EAS).

services/zpush/apache/zpush.conf

@@ -0,0 +1,21 @@
+# Z-Push EAS endpoints. EAS device ids arrive URL-encoded in the query
+# string and may contain encoded slashes.
+AllowEncodedSlashes On
+
+Alias /Microsoft-Server-ActiveSync /usr/share/z-push/index.php
+
+# All capitalizations clients probe. The router answers mobilesync-schema
+# requests itself and proxies outlook-schema (mail) requests to Stalwart.
+Alias /autodiscover/autodiscover.xml /usr/share/z-push/autodiscover/router.php
+Alias /Autodiscover/Autodiscover.xml /usr/share/z-push/autodiscover/router.php
+Alias /AutoDiscover/AutoDiscover.xml /usr/share/z-push/autodiscover/router.php
+
+<Directory /usr/share/z-push>
+    Options -Indexes
+    AllowOverride None
+    Require all granted
+</Directory>
+
+# Expose the raw Authorization header to PHP so the autodiscover proxy can
+# forward it upstream verbatim (mod_php only decodes Basic into PHP_AUTH_*).
+SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1