feat(mail): Outlook/Thunderbird autodiscovery over HTTPS

Outlook autodiscovers via POST https://autodiscover.<domain>/autodiscover/
autodiscover.xml and Thunderbird via autoconfig.<domain>/mail/
config-v1.1.xml — Stalwart serves both (verified, answers carry
mail.dezky.eu:993/465) but its HTTP listener wasn't reachable from
outside (the node's :443 is Traefik's). New exact-path-only Ingress
routes JUST those discovery endpoints to host-Stalwart via a selectorless
Service + Endpoints on the cni0 gateway; the admin/management surface
stays internal, and there's no HTTPS-redirect middleware because
Thunderbird probes plain HTTP and Outlook POSTs.

Domains page now also lists the autoconfig/autodiscover CNAMEs under the
autodiscovery slot (CNAME verified against the mail host; a bare A record
warns instead of failing). Customer-domain autodiscovery (per-domain
certs + automated Ingress) is a follow-up.

infrastructure/production/fleet/apps/kustomization.yaml

@@ -7,6 +7,7 @@ namespace: dezky-apps
 resources:
   - namespace.yaml
   - redirect-middleware.yaml
+  - mail-autodiscovery.yaml
   - platform-api-config.yaml
   - platform-api.yaml
   - portal.yaml

infrastructure/production/fleet/apps/mail-autodiscovery.yaml

@@ -0,0 +1,74 @@
+# Mail-client autodiscovery for dezky.eu — routes ONLY the discovery paths
+# through Traefik to host-Stalwart's HTTP listener (10.42.0.1:8080):
+#
+#   autodiscover.dezky.eu  POST /autodiscover/autodiscover.xml   (Outlook)
+#   autoconfig.dezky.eu    GET  /mail/config-v1.1.xml            (Thunderbird)
+#
+# Everything else on these hostnames (Stalwart's /admin, /login, /jmap …)
+# falls through to Traefik's 404 — the management surface stays internal.
+# No HTTPS-redirect middleware on purpose: Thunderbird probes plain HTTP and
+# Outlook POSTs, which doesn't survive a 301 in all clients; both schemes
+# serve the same answer.
+#
+# DNS at simply.com: autoconfig + autodiscover CNAME → mail.dezky.eu (the
+# records are listed on the portal's Domains page).
+#
+# Customer domains (autodiscover.<customer>.tld) need per-domain certs and an
+# automated Ingress/Certificate per verified domain — follow-up feature.
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart-http
+  labels:
+    app.kubernetes.io/name: stalwart-http
+    app.kubernetes.io/part-of: dezky
+spec:
+  # No selector — Stalwart runs on the HOST, not in a pod. The Endpoints
+  # object below pins the cni0 gateway address pods/Traefik can reach.
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 8080
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: stalwart-http
+subsets:
+  - addresses:
+      - ip: 10.42.0.1
+    ports:
+      - name: http
+        port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mail-autodiscovery
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - autodiscover.dezky.eu
+        - autoconfig.dezky.eu
+      secretName: autodiscovery-dezky-eu-tls
+  rules:
+    - host: autodiscover.dezky.eu
+      http:
+        paths:
+          # Outlook probes both capitalizations.
+          - path: /autodiscover/autodiscover.xml
+            pathType: Exact
+            backend: { service: { name: stalwart-http, port: { number: 8080 } } }
+          - path: /Autodiscover/Autodiscover.xml
+            pathType: Exact
+            backend: { service: { name: stalwart-http, port: { number: 8080 } } }
+    - host: autoconfig.dezky.eu
+      http:
+        paths:
+          - path: /mail/config-v1.1.xml
+            pathType: Exact
+            backend: { service: { name: stalwart-http, port: { number: 8080 } } }