feat(mail): Z-Push Exchange ActiveSync gateway for mobile clients

Wraps Stalwart in EAS so iOS/Android native Mail/Calendar 'Exchange'
accounts get two-way mail+calendar+contacts sync (BackendCombined:
IMAP + CalDAV /dav/cal/%l/ + CardDAV, credentials pass through).

- services/zpush: Z-Push 2.6.4 (AGPLv3, see LICENSE-NOTES.md) on
  php:8.2-apache-bookworm (trixie dropped libc-client); PHP 8 sysv
  sprintf fatal sed-patched; autodiscover dispatcher answers
  mobilesync schema, proxies outlook schema to Stalwart unchanged
- prod: zpush Deployment (replicas:1, Recreate — file sync state),
  /Microsoft-Server-ActiveSync Ingress on mail.dezky.eu (no redirect,
  POST-heavy), autodiscover.dezky.eu repointed to the dispatcher,
  selectorless stalwart-imaps/-smtps Services (host-Stalwart is
  implicit-TLS only: 993/465, no plain 143/587 — verified on node1)
- CI: build+deploy zpush like the other apps

EAS tops out at 14.1: covers native mobile clients, NOT the Outlook
mobile app (needs 16.1) and not new Outlook for Windows (no EAS).

services/zpush/config/caldav.config.php

@@ -0,0 +1,23 @@
+<?php
+// dezky replacement for Z-Push's backend/caldav/config.php (applied at
+// image build, see Dockerfile).
+//
+// Stalwart serves per-account calendars at /dav/cal/<account>/ where
+// <account> is the Stalwart account name — the LOCAL PART of the mail
+// address (platform-api creates mailboxes with name=localPart, see
+// services/platform-api/src/integrations/stalwart.client.ts). Logins are
+// full emails (USE_FULLEMAIL_FOR_LOGIN), so the path uses %l, Z-Push's
+// local-part placeholder, not %u.
+
+define('CALDAV_PROTOCOL', 'http');
+define('CALDAV_SERVER', getenv('CALDAV_SERVER') ?: 'stalwart');
+define('CALDAV_PORT', getenv('CALDAV_PORT') ?: '8080');
+define('CALDAV_PATH', '/dav/cal/%l/');
+
+// Stalwart auto-creates a calendar named "default" for every account.
+define('CALDAV_PERSONAL', 'default');
+
+// sync-collection REPORT (RFC 6578). Start with the safe full-comparison
+// mode; flip to true once proven against Stalwart's DAV implementation.
+define('CALDAV_SUPPORTS_SYNC', false);
+define('CALDAV_MAX_SYNC_PERIOD', 2147483647);