feat(domains): surface autodiscovery SRV records (RFC 6186)

Mail clients could never autoconfigure: Stalwart's zone file contains the
_imaps/_submissions/_pop3s SRV records but classify() dropped everything
except mx/spf/dkim/dmarc, so customers never saw them and every client
needed manual server entry. New 'autodiscovery' record kind: classified
from the zone (only the services actually reachable in prod — the
_jmap/_caldavs SRVs target :443 which Traefik owns, deferred to the
webmail story), verified via resolveSrv (missing=bad, wrong target=warn),
shown as an OPTIONAL slot on the portal Domains page that never gates the
domain status or the records-to-fix nag.

Also fixed on the live server via management JMAP (x:SystemSettings):
hostname was the machine name node1.dezky.eu from the v0.16 auto-bootstrap
— MX/SRV targets and the SMTP banner now say mail.dezky.eu, and the LE
x:Certificate is set as defaultCertificateId.

services/platform-api/src/schemas/domain.schema.ts

@@ -15,8 +15,11 @@ export type DomainStatus = 'pending' | 'verifying' | 'active' | 'error'
 export type RecordStatus = 'ok' | 'warn' | 'bad' | 'pending'
 
 // Which DNS concern a record belongs to. `ownership` is the one-time TXT proving
-// the customer controls the domain; the other four map to the UI's status slots.
-export type RecordKind = 'ownership' | 'mx' | 'spf' | 'dkim' | 'dmarc'
+// the customer controls the domain; mx/spf/dkim/dmarc map to the UI's required
+// status slots. `autodiscovery` carries the optional SRV records (RFC 6186)
+// that let mail clients configure themselves from just an email address — it
+// never gates the domain's overall status.
+export type RecordKind = 'ownership' | 'mx' | 'spf' | 'dkim' | 'dmarc' | 'autodiscovery'
 
 export type DmarcPolicy = 'none' | 'quarantine' | 'reject'