feat(portal): Exchange account setup hint on the Users page

Mailbox section now explains adding the mailbox as an Exchange
account on iPhone/Android (built-in apps, not the Outlook app) and
points Windows Outlook users at the CalDAV Synchronizer add-in.
Apple profile header comment updated — EAS now exists via the zpush
gateway, but the .mobileconfig stays the preferred Apple path.

apps/portal/pages/admin/users.vue

@@ -768,6 +768,9 @@ async function submitCreateMailbox() {
                 <template v-if="hasMailbox">This is the member’s workspace mailbox. To add another address that delivers to the same inbox, add an alias below.</template>
                 <template v-else>This member signs in with an external address and has no inbox. Create a mailbox on your domain to give them one — and to enable aliases.</template>
               </p>
+              <p v-if="hasMailbox" class="ud-hint">
+                On iPhone and Android the mailbox can also be added as an <strong>Exchange</strong> account — mail, calendar and contacts in one go. Server <Mono>{{ mailHost }}</Mono>, username is the mailbox address. Works in the built-in mail apps (not the Outlook app); on Windows, Outlook syncs the calendar via the free CalDAV Synchronizer add-in.
+              </p>
             </div>
           </section>
 

apps/portal/server/api/apple-mailconfig.get.ts

@@ -1,7 +1,9 @@
 // Apple configuration profile (.mobileconfig) for one-click Mail setup on
 // macOS/iOS — the Apple answer to autodiscovery (Apple Mail ignores RFC 6186
-// SRV records, and "Microsoft Exchange" needs EWS/EAS which Stalwart doesn't
+// SRV records). On iOS adding the mailbox as an "Exchange" account also
-// speak). The profile carries server settings + the address but NO password:
+// works now (the Z-Push EAS gateway, services/zpush), but this profile stays
+// the preferred Apple path: native IMAP+DAV, no protocol translation layer.
+// The profile carries server settings + the address but NO password:
 // profiles are plaintext XML, so Apple prompts for the password on install.
 //
 // Session-gated like every portal API. The mail host comes from runtime