docs(mail): correct ActiveSync claims + honest client-compat copy

Stalwart never had ActiveSync built in — that now comes from the
zpush gateway. SERVICES.md gains a zpush section with debug
commands; website copy (da+en) states what actually works: IMAP
everywhere, CalDAV/CardDAV, Exchange accounts in the phone's
built-in apps, CalDAV Synchronizer for Outlook on Windows.

docs/SERVICES.md

@@ -119,7 +119,8 @@ See `docs/AUTHENTIK-SETUP.md` for OIDC configuration steps.
 **Image:** `stalwartlabs/mail-server:latest`
 **Container:** `dezky-stalwart`
 **URL:** https://mail.dezky.local
-**Purpose:** Mail server (SMTP/IMAP/JMAP/CalDAV/CardDAV/ActiveSync)
+**Purpose:** Mail server (SMTP/IMAP/JMAP/CalDAV/CardDAV — ActiveSync comes
+from the separate zpush gateway, see below)
 
 **Ports exposed:**
 - 25 (SMTP)
@@ -149,6 +150,43 @@ docker compose port stalwart 25
 
 ---
 
+## Z-Push (EAS gateway)
+
+**Image:** built from `services/zpush` (Z-Push 2.6.4, AGPLv3 — see
+`services/zpush/LICENSE-NOTES.md`)
+**Container:** `dezky-zpush`
+**URL:** https://mail.dezky.local/Microsoft-Server-ActiveSync (+ EAS
+autodiscover on https://autodiscover.dezky.local)
+**Purpose:** Exchange ActiveSync gateway in front of Stalwart — "Exchange"
+accounts on iOS/Android native Mail/Calendar get two-way mail + calendar +
+contacts sync (IMAP + CalDAV + CardDAV fan-out via BackendCombined).
+
+**Protocol reality check:** EAS 14.1. Covers native mobile clients; NOT the
+Outlook mobile app (requires EAS 16.1) and not new Outlook for Windows (no
+EAS at all). Classic Outlook on Windows syncs calendars against `/dav` with
+the free Outlook CalDAV Synchronizer add-in instead.
+
+**Auth:** pure passthrough — the device's Basic credentials (mailbox
+password or app password) go straight to Stalwart. No secrets stored;
+`zpush_state` volume holds only resyncable device state.
+
+**Debug:**
+```bash
+docker compose logs -f zpush
+
+# Unauthenticated probe (expect 401 with realm="ZPush")
+curl -k -i -X OPTIONS https://mail.dezky.local/Microsoft-Server-ActiveSync
+
+# Authenticated: advertised EAS versions in MS-ASProtocolVersions header
+curl -k -i -u user@tenant.tld:app-password -X OPTIONS \
+  https://mail.dezky.local/Microsoft-Server-ActiveSync
+
+# Per-device sync state
+docker exec dezky-zpush php /usr/share/z-push/z-push-admin.php -a list
+```
+
+---
+
 ## OCIS
 
 **Image:** `owncloud/ocis:7.0`