app-email rollout: gitea + rallly mappings; calcom/nextcloud/immich = findings

gitea (STARTTLS + FORCE_TRUST_SERVER_CERT) and rallly (Nodemailer STARTTLS +
SMTP_REJECT_UNAUTHORIZED=false) wired. Fixed rallly's non-existent 3.12.1 pin → 3.11.2.
calcom/nextcloud/immich don't fit the mechanism (self-signed opportunistic-STARTTLS,
split From, no-SMTP-env) — see FINDING doc in felhom.eu.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/rallly/docker-compose.yml

@@ -10,7 +10,7 @@
 
 services:
   rallly:
-    image: lukevella/rallly:3.12.1
+    image: lukevella/rallly:3.11.2
     container_name: rallly
     restart: unless-stopped
     depends_on:
@@ -21,6 +21,16 @@ services:
       - DATABASE_URL=postgresql://rallly:${DB_PASSWORD}@rallly-postgres:5432/rallly
       - SECRET_PASSWORD=${SECRET_PASSWORD}
       - NEXT_PUBLIC_BASE_URL=https://${SUBDOMAIN}.${DOMAIN}
+      # App-email (managed relay). Injected by the controller only when app-email is on (global +
+      # per-app); empty SMTP_HOST keeps Rallly mail disabled. Rallly (Nodemailer) reads these at send
+      # time. SMTP_SECURE=false → STARTTLS to the shim; SMTP_REJECT_UNAUTHORIZED=false accepts the
+      # shim's self-signed cert (v4 flag; v3.x accepts self-signed by default). See .felhom.yml smtp_mapping.
+      - SMTP_HOST=${SMTP_HOST:-}
+      - SMTP_PORT=${SMTP_PORT:-587}
+      - SMTP_SECURE=${SMTP_SECURE:-false}
+      - SMTP_REJECT_UNAUTHORIZED=${SMTP_REJECT_UNAUTHORIZED:-true}
+      - NOREPLY_EMAIL=${NOREPLY_EMAIL:-}
+      - NOREPLY_EMAIL_NAME=${NOREPLY_EMAIL_NAME:-Felhom}
     networks:
       - traefik-public
       - rallly-internal