feat(mail): CalDAV/CardDAV exposed + in the Apple profile

DAV was internal-only (the node's :443 is Traefik's). New mail-dav
Ingress routes /.well-known/caldav, /.well-known/carddav and /dav on
mail.dezky.eu through to Stalwart — with the HTTPS-redirect middleware
(safe for DAV's GET/PROPFIND; kept OFF the autodiscover Ingress whose
POSTs don't survive redirects). The _caldavs/_carddavs SRV records are
now legitimate, so the Domains page surfaces them, and the Apple
.mobileconfig gains CalDAV + CardDAV payloads: one install sets up Mail,
Calendar and Contacts on Mac/iPhone. Stalwart's STALWART_PUBLIC_URL is
set to https://mail.dezky.eu on the host (discovery documents).

infrastructure/production/fleet/apps/mail-autodiscovery.yaml

@@ -75,3 +75,36 @@ spec:
           - path: /mail/config-v1.1.xml
             pathType: Exact
             backend: { service: { name: stalwart-http, port: { number: 8080 } } }
+---
+# CalDAV/CardDAV for mail.dezky.eu — Apple Calendar/Contacts, Thunderbird and
+# every other DAV client. Separate Ingress from the autodiscovery one because
+# DAV gets the HTTPS-redirect middleware (safe for GET/PROPFIND; the
+# autodiscover Ingress must stay redirect-free for Outlook's POST). Only the
+# well-knowns + /dav are routed — the admin surface stays internal.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mail-dav
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: dezky-apps-redirect-https@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - mail.dezky.eu
+      secretName: mail-dezky-eu-traefik-tls
+  rules:
+    - host: mail.dezky.eu
+      http:
+        paths:
+          - path: /.well-known/caldav
+            pathType: Exact
+            backend: { service: { name: stalwart-http, port: { number: 8080 } } }
+          - path: /.well-known/carddav
+            pathType: Exact
+            backend: { service: { name: stalwart-http, port: { number: 8080 } } }
+          - path: /dav
+            pathType: Prefix
+            backend: { service: { name: stalwart-http, port: { number: 8080 } } }