feat(mail): Outlook/Thunderbird autodiscovery over HTTPS

Outlook autodiscovers via POST https://autodiscover.<domain>/autodiscover/
autodiscover.xml and Thunderbird via autoconfig.<domain>/mail/
config-v1.1.xml — Stalwart serves both (verified, answers carry
mail.dezky.eu:993/465) but its HTTP listener wasn't reachable from
outside (the node's :443 is Traefik's). New exact-path-only Ingress
routes JUST those discovery endpoints to host-Stalwart via a selectorless
Service + Endpoints on the cni0 gateway; the admin/management surface
stays internal, and there's no HTTPS-redirect middleware because
Thunderbird probes plain HTTP and Outlook POSTs.

Domains page now also lists the autoconfig/autodiscover CNAMEs under the
autodiscovery slot (CNAME verified against the mail host; a bare A record
warns instead of failing). Customer-domain autodiscovery (per-domain
certs + automated Ingress) is a follow-up.

infrastructure/production/fleet/apps/kustomization.yaml

@@ -7,6 +7,7 @@ namespace: dezky-apps
 resources:
   - namespace.yaml
   - redirect-middleware.yaml
+  - mail-autodiscovery.yaml
   - platform-api-config.yaml
   - platform-api.yaml
   - portal.yaml