app-email: smtp_mapping for vaultwarden + mealie

Vaultwarden via STARTTLS (accepts self-signed shim cert); Mealie via plaintext
(NONE) — no accept-invalid-cert option, spike-validated mode. Compose files
reference injected ${SMTP_*}. README documents the pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 2026-06-29 — App-email: smtp_mapping for Vaultwarden + Mealie
+- Added the `smtp_mapping` block to `templates/vaultwarden/.felhom.yml` and `templates/mealie/.felhom.yml`,
+  enabling managed outbound email (app → in-controller shim → hub → Resend) for the two spike-proven apps
+  (`SPIKE-smtp-app-relay-2026-06-28`). The controller injects `SMTP_*` at deploy/redeploy when app-email is
+  on (global + per-app); the From address is `<app>@felhom.eu`. SMTP auth creds are intentionally left unset
+  (the shim accepts no-auth on the Docker network).
+  - **Vaultwarden:** STARTTLS (`SMTP_SECURITY=starttls`) + `SMTP_ACCEPT_INVALID_CERTS/HOSTNAMES=true` to
+    accept the shim's self-signed cert.
+  - **Mealie:** plaintext (`SMTP_AUTH_STRATEGY=NONE`) on :2525 — Mealie has no accept-invalid-cert option, so
+    STARTTLS to a self-signed shim would fail; plaintext to the Docker-network-only shim is the spike-validated
+    mode.
+- Both `docker-compose.yml` files now reference the injected `${SMTP_*}` keys (with harmless defaults) so the
+  values reach the container; empty `SMTP_HOST` keeps mail disabled when the toggle is off.
+- Documented the `smtp_mapping` pattern in `README.md` so further apps are easy adds.
+
 ## 2026-06-28 — Add SparkyFitness (v0.17.2) — nutrition/workout tracker
 - New app `templates/sparkyfitness/{docker-compose.yml,.felhom.yml}`: a self-hosted nutrition/calorie +
   workout/weight tracker (alternative to wger). Three containers — nginx **frontend** (SPA :80, the sole