app-email rollout: gitea + rallly mappings; calcom/nextcloud/immich = findings

gitea (STARTTLS + FORCE_TRUST_SERVER_CERT) and rallly (Nodemailer STARTTLS +
SMTP_REJECT_UNAUTHORIZED=false) wired. Fixed rallly's non-existent 3.12.1 pin → 3.11.2.
calcom/nextcloud/immich don't fit the mechanism (self-signed opportunistic-STARTTLS,
split From, no-SMTP-env) — see FINDING doc in felhom.eu.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/gitea/.felhom.yml

@@ -61,3 +61,18 @@ healthcheck:
       path: "/api/healthz"
       expect:
         status: 200
+
+# --- App-email mapping (apps → in-controller shim → hub → Resend) ---
+# Gitea uses STARTTLS to the shim and trusts its self-signed cert via FORCE_TRUST_SERVER_CERT.
+# Gitea applies GITEA__* env on every boot, so toggling app-email + redeploy takes effect. The From
+# is Gitea's single GITEA__mailer__FROM; USER/PASSWD stay unset (the shim accepts no-auth).
+smtp_mapping:
+  host_var: GITEA__mailer__SMTP_ADDR
+  port_var: GITEA__mailer__SMTP_PORT
+  security_var: GITEA__mailer__PROTOCOL
+  security_value: "smtp+starttls"
+  from_var: GITEA__mailer__FROM
+  from_local: gitea
+  extra:
+    GITEA__mailer__ENABLED: "true"
+    GITEA__mailer__FORCE_TRUST_SERVER_CERT: "true"