app-email rollout: gitea + rallly mappings; calcom/nextcloud/immich = findings

gitea (STARTTLS + FORCE_TRUST_SERVER_CERT) and rallly (Nodemailer STARTTLS +
SMTP_REJECT_UNAUTHORIZED=false) wired. Fixed rallly's non-existent 3.12.1 pin → 3.11.2.
calcom/nextcloud/immich don't fit the mechanism (self-signed opportunistic-STARTTLS,
split From, no-SMTP-env) — see FINDING doc in felhom.eu.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/rallly/.felhom.yml

@@ -68,3 +68,18 @@ healthcheck:
   checks:
     - type: http
       port: 3000
+
+# --- App-email mapping (apps → in-controller shim → hub → Resend) ---
+# Rallly (Nodemailer) uses STARTTLS to the shim (SMTP_SECURE=false) and accepts the shim's self-signed
+# cert (SMTP_REJECT_UNAUTHORIZED=false on v4; v3.x accepts by default). From = Rallly's single
+# NOREPLY_EMAIL; SMTP_USER/SMTP_PWD stay unset (the shim accepts no-auth).
+smtp_mapping:
+  host_var: SMTP_HOST
+  port_var: SMTP_PORT
+  security_var: SMTP_SECURE
+  security_value: "false"
+  from_var: NOREPLY_EMAIL
+  from_name_var: NOREPLY_EMAIL_NAME
+  from_local: rallly
+  extra:
+    SMTP_REJECT_UNAUTHORIZED: "false"