feat(mail): Z-Push Exchange ActiveSync gateway for mobile clients

Wraps Stalwart in EAS so iOS/Android native Mail/Calendar 'Exchange'
accounts get two-way mail+calendar+contacts sync (BackendCombined:
IMAP + CalDAV /dav/cal/%l/ + CardDAV, credentials pass through).

- services/zpush: Z-Push 2.6.4 (AGPLv3, see LICENSE-NOTES.md) on
  php:8.2-apache-bookworm (trixie dropped libc-client); PHP 8 sysv
  sprintf fatal sed-patched; autodiscover dispatcher answers
  mobilesync schema, proxies outlook schema to Stalwart unchanged
- prod: zpush Deployment (replicas:1, Recreate — file sync state),
  /Microsoft-Server-ActiveSync Ingress on mail.dezky.eu (no redirect,
  POST-heavy), autodiscover.dezky.eu repointed to the dispatcher,
  selectorless stalwart-imaps/-smtps Services (host-Stalwart is
  implicit-TLS only: 993/465, no plain 143/587 — verified on node1)
- CI: build+deploy zpush like the other apps

EAS tops out at 14.1: covers native mobile clients, NOT the Outlook
mobile app (needs 16.1) and not new Outlook for Windows (no EAS).

services/zpush/config/autodiscover.config.php

@@ -0,0 +1,32 @@
+<?php
+// dezky replacement for Z-Push's autodiscover/config.php (applied at image
+// build, see Dockerfile). Only mobilesync-schema requests reach this code —
+// router.php proxies outlook-schema (mail) autodiscover to Stalwart.
+
+// Public hostname EAS devices should be pointed at. The ActiveSync URL in
+// the response becomes https://<ZPUSH_HOST>/Microsoft-Server-ActiveSync.
+define('ZPUSH_HOST', getenv('ZPUSH_HOST') ?: 'mail.dezky.eu');
+
+define('TIMEZONE', 'Europe/Copenhagen');
+define('BASE_PATH', dirname($_SERVER['SCRIPT_FILENAME']) . '/');
+
+// Devices authenticate as the full mail address — matches the main config
+// and what the portal tells users.
+define('USE_FULLEMAIL_FOR_LOGIN', true);
+define('AUTODISCOVER_LOGIN_TYPE', AUTODISCOVER_LOGIN_EMAIL);
+
+// Autodiscover authenticates the requesting user through the same backend
+// stack as sync does (ZPush::GetBackend() reads this constant from THIS
+// file, not from the main config.php).
+define('BACKEND_PROVIDER', 'BackendCombined');
+
+define('LOGBACKEND', 'filelog');
+define('LOGFILEDIR', '/var/log/z-push/');
+define('LOGFILE', LOGFILEDIR . 'autodiscover.log');
+define('LOGERRORFILE', LOGFILEDIR . 'autodiscover-error.log');
+define('LOGLEVEL', LOGLEVEL_INFO);
+define('LOGUSERLEVEL', LOGLEVEL_DEVICEID);
+
+// The logger passes this global straight to SetSpecialLogUsers(array) —
+// it must exist even when no per-user WBXML debugging is wanted.
+$specialLogUsers = array();