feat(mail): Z-Push Exchange ActiveSync gateway for mobile clients

Wraps Stalwart in EAS so iOS/Android native Mail/Calendar 'Exchange'
accounts get two-way mail+calendar+contacts sync (BackendCombined:
IMAP + CalDAV /dav/cal/%l/ + CardDAV, credentials pass through).

- services/zpush: Z-Push 2.6.4 (AGPLv3, see LICENSE-NOTES.md) on
  php:8.2-apache-bookworm (trixie dropped libc-client); PHP 8 sysv
  sprintf fatal sed-patched; autodiscover dispatcher answers
  mobilesync schema, proxies outlook schema to Stalwart unchanged
- prod: zpush Deployment (replicas:1, Recreate — file sync state),
  /Microsoft-Server-ActiveSync Ingress on mail.dezky.eu (no redirect,
  POST-heavy), autodiscover.dezky.eu repointed to the dispatcher,
  selectorless stalwart-imaps/-smtps Services (host-Stalwart is
  implicit-TLS only: 993/465, no plain 143/587 — verified on node1)
- CI: build+deploy zpush like the other apps

EAS tops out at 14.1: covers native mobile clients, NOT the Outlook
mobile app (needs 16.1) and not new Outlook for Windows (no EAS).

services/zpush/config/combined.config.php

@@ -0,0 +1,44 @@
+<?php
+// dezky replacement for Z-Push's backend/combined/config.php (applied at
+// image build, see Dockerfile). One EAS account fans out to three Stalwart
+// protocols: mail over IMAP, calendar/tasks over CalDAV, contacts over
+// CardDAV. Login succeeds only if every backend authenticates — they all
+// hit the same Stalwart account with the same credentials, so that's one
+// effective check.
+
+class BackendCombinedConfig {
+
+    public static function GetBackendCombinedConfig() {
+        return array(
+            'backends' => array(
+                'i' => array('name' => 'BackendIMAP'),
+                'c' => array('name' => 'BackendCalDAV'),
+                'd' => array('name' => 'BackendCardDAV'),
+            ),
+            'delimiter' => '/',
+            'folderbackend' => array(
+                SYNC_FOLDER_TYPE_INBOX => 'i',
+                SYNC_FOLDER_TYPE_DRAFTS => 'i',
+                SYNC_FOLDER_TYPE_WASTEBASKET => 'i',
+                SYNC_FOLDER_TYPE_SENTMAIL => 'i',
+                SYNC_FOLDER_TYPE_OUTBOX => 'i',
+                SYNC_FOLDER_TYPE_OTHER => 'i',
+                SYNC_FOLDER_TYPE_USER_MAIL => 'i',
+                SYNC_FOLDER_TYPE_APPOINTMENT => 'c',
+                SYNC_FOLDER_TYPE_USER_APPOINTMENT => 'c',
+                SYNC_FOLDER_TYPE_TASK => 'c',
+                SYNC_FOLDER_TYPE_USER_TASK => 'c',
+                SYNC_FOLDER_TYPE_CONTACT => 'd',
+                SYNC_FOLDER_TYPE_USER_CONTACT => 'd',
+                // No notes/journal store in Stalwart — let mail own the rest
+                // so folder creation never lands on a DAV backend by surprise.
+                SYNC_FOLDER_TYPE_NOTE => 'i',
+                SYNC_FOLDER_TYPE_USER_NOTE => 'i',
+                SYNC_FOLDER_TYPE_JOURNAL => 'i',
+                SYNC_FOLDER_TYPE_USER_JOURNAL => 'i',
+                SYNC_FOLDER_TYPE_UNKNOWN => 'i',
+            ),
+            'rootcreatefolderbackend' => 'i',
+        );
+    }
+}