feat(auth): codes go by mail, through the SMTP service an instance sets up

Email sign-in's codes are mailed over SMTP (pub.dev's mailer), through
whichever service the passwords name: emailSmtpHost, emailSmtpPort,
emailSmtpUser, emailSmtpPassword and emailFrom (EMAIL_SMTP_* and
EMAIL_FROM in deploy/.env, with EMAIL_SIGN_IN_PEPPER). TLS only:
STARTTLS, or TLS directly on 465. learn.halkyon.eu sends through Proton's
SMTP submission. Without a service, codes still go to the log in
development, and elsewhere there is no email sign-in.

The mail is plain text, in English or German: the code first and in the
subject, so it shows in the notification and the system can offer it,
the instance it signs in to, its 15 minutes, and that it can be ignored;
no links, no tracking, no HTML. A mail that couldn't be sent is a refusal
of its own (mailFailed): nothing of the request is kept, and the log
names the error's type only, as the service's answer may name the
address. A fake SMTP server on loopback drives the real mailer in the
tests: it delivers, and nothing goes to a server without TLS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/.env.example

@@ -32,6 +32,26 @@ SESSION_KEY_HASH_PEPPER=
 GITHUB_CLIENT_ID=
 GITHUB_CLIENT_SECRET=
 
+# Email sign-in (optional, ADR 0010): people sign in with a code mailed to their address,
+# of which the instance keeps only a keyed hash. Off unless the pepper and all of the SMTP
+# service's settings are set; the app then doesn't offer it.
+# The pepper: NEVER change it once anybody signs in with an address, as every address's
+# hash would be lost, and with it those people's way in.
+# Generate: openssl rand -hex 32
+EMAIL_SIGN_IN_PEPPER=
+# The SMTP service codes go through, over TLS only (STARTTLS, or TLS directly on 465).
+# Proton (a paid plan with an address on your own domain): smtp.protonmail.ch, 587, the
+# address as the user, an SMTP token made for it in Proton Mail's settings (IMAP/SMTP) as
+# the password, and the same address as EMAIL_FROM. Some hosts block outgoing 25 and 465;
+# 587 gets through.
+EMAIL_SMTP_HOST=
+EMAIL_SMTP_PORT=587
+EMAIL_SMTP_USER=
+EMAIL_SMTP_PASSWORD=
+# The address codes come from (shown as "Halkyon Learn"); its domain needs SPF, DKIM and
+# DMARC records for the service, or mail lands in spam.
+EMAIL_FROM=
+
 # Where the source of what this instance runs is, shown in the app's About dialog: both
 # licences (AGPL for the app, SSPL for the server) require offering it to the people who
 # use the instance. Empty: the project's repository, which is right for unmodified code.