app-email: smtp_mapping for vaultwarden + mealie

Vaultwarden via STARTTLS (accepts self-signed shim cert); Mealie via plaintext
(NONE) — no accept-invalid-cert option, spike-validated mode. Compose files
reference injected ${SMTP_*}. README documents the pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/vaultwarden/docker-compose.yml

@@ -28,6 +28,15 @@ services:
       - ADMIN_TOKEN=${ADMIN_TOKEN:-}
       - WEBSOCKET_ENABLED=true
       - TZ=Europe/Budapest
+      # App-email (managed relay). Injected by the controller only when app-email is on
+      # (global + per-app); empty SMTP_HOST = Vaultwarden mail stays disabled. See .felhom.yml smtp_mapping.
+      - SMTP_HOST=${SMTP_HOST:-}
+      - SMTP_PORT=${SMTP_PORT:-587}
+      - SMTP_SECURITY=${SMTP_SECURITY:-off}
+      - SMTP_FROM=${SMTP_FROM:-}
+      - SMTP_FROM_NAME=${SMTP_FROM_NAME:-}
+      - SMTP_ACCEPT_INVALID_CERTS=${SMTP_ACCEPT_INVALID_CERTS:-false}
+      - SMTP_ACCEPT_INVALID_HOSTNAMES=${SMTP_ACCEPT_INVALID_HOSTNAMES:-false}
     volumes:
       - vaultwarden_data:/data
     networks: