fix(vaultwarden): _ENABLE_SMTP boot-gate — fresh email-off deploys crash-looped (campaign F1)

Vaultwarden treats defined-but-empty SMTP_HOST/SMTP_FROM as "set"; with upstream
_enable_smtp defaulting true its validation errors out and the container
crash-loops on every fresh deploy with app-email off (the default). Gate the
SMTP group with _ENABLE_SMTP: compose default false (clean boot, mail off),
flipped "true" by the app-email injection via smtp_mapping.extra. Proven on the
pinned 1.33.2-alpine image (P1 repro exit 12 / P2 off boots / P3 on boots).
REUSE.md: strict-image TRAP row. Sweep note: the other 5 smtp-mapped templates
are campaign-boot-proven tolerant; no edits.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

templates/vaultwarden/.felhom.yml

@@ -102,3 +102,7 @@ smtp_mapping:
   extra:
     SMTP_ACCEPT_INVALID_CERTS: "true"
     SMTP_ACCEPT_INVALID_HOSTNAMES: "true"
+    # Boot-gate for Vaultwarden's strict SMTP validation (campaign finding F1, 2026-07-06):
+    # the image errors out when SMTP_HOST/SMTP_FROM are defined-but-empty, so the compose
+    # default is _ENABLE_SMTP=false and this injection flips it on with the rest of the group.
+    _ENABLE_SMTP: "true"

templates/vaultwarden/docker-compose.yml

@@ -29,7 +29,14 @@ services:
       - WEBSOCKET_ENABLED=true
       - TZ=Europe/Budapest
       # App-email (managed relay). Injected by the controller only when app-email is on
-      # (global + per-app); empty SMTP_HOST = Vaultwarden mail stays disabled. See .felhom.yml smtp_mapping.
+      # (global + per-app); see .felhom.yml smtp_mapping.
+      # TRAP (campaign finding F1, 2026-07-06): Vaultwarden treats a defined-but-EMPTY env var as
+      # "set" — with SMTP_HOST/SMTP_FROM both defined-empty its config validation errors out and
+      # the container crash-loops. The whole SMTP group is therefore gated by _ENABLE_SMTP
+      # (default false = validation skipped, mail off); the controller's app-email injection flips
+      # it to true via smtp_mapping.extra. Note: a config.json saved from the admin panel would
+      # override these env values — not applicable to fresh deploys.
+      - _ENABLE_SMTP=${_ENABLE_SMTP:-false}
       - SMTP_HOST=${SMTP_HOST:-}
       - SMTP_PORT=${SMTP_PORT:-587}
       - SMTP_SECURITY=${SMTP_SECURITY:-off}