v0.88.0: app-email SMTP relay (in-process shim + per-app injection)

In-process go-smtp shim (Shape 1): apps → shim → hub → Resend, Resend key stays
hub-side. From-header allowlist (reject 5xx pre-hub), single-shot raw-MIME forward,
status→SMTP mapping. Global + per-app toggles gate compose-time env injection from
.felhom.yml smtp_mapping. Hungarian UI on settings + app config pages.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/cmd/controller/main.go

@@ -29,6 +29,7 @@ import (
 	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/crypto"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/integrations"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/mailrelay"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/metrics"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/monitor"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/notify"
@@ -240,6 +241,28 @@ func main() {
 	// --- Initialize notifier ---
 	notifier := notify.New(cfg.Hub.URL, cfg.Hub.APIKey, cfg.Customer.ID, sett, logger, cfg.Logging.Level == "debug")
 
+	// --- Initialize the app-email SMTP shim (mailrelay) ---
+	// In-process shim: apps → shim → hub → Resend (the Resend key stays hub-side). It runs only
+	// when the controller has a hub (URL+key) AND the operational kill-switch is on; the runtime
+	// global app-email toggle then decides whether it actually listens (Lifecycle.Apply). Listeners
+	// bind to the app Docker network only — never published to the host/internet.
+	var mailShim *mailrelay.Lifecycle
+	if cfg.Hub.URL != "" && cfg.Hub.APIKey != "" && cfg.MailRelay.HardEnabled() {
+		mailShim = mailrelay.NewLifecycle(mailrelay.Options{
+			PlainAddr:   cfg.MailRelay.PlainListen,
+			TLSAddr:     cfg.MailRelay.TLSListen,
+			ServiceName: cfg.MailRelay.ShimHost,
+			Policy:      mailrelay.NewPolicy(cfg.MailRelay.FromDomains),
+			Forwarder:   mailrelay.NewHubForwarder(cfg.Hub.URL, cfg.Hub.APIKey),
+			Logger:      logger,
+		})
+		if err := mailShim.Apply(sett.AppEmailEnabled()); err != nil {
+			logger.Printf("[ERROR] [mailrelay] could not start app-email shim: %v", err)
+		}
+	} else {
+		logger.Printf("[INFO] [mailrelay] app-email shim unavailable (no hub configured or disabled in config)")
+	}
+
 	// --- Initialize self-updater ---
 	var updater *selfupdate.Updater
 	if cfg.SelfUpdate.Enabled {
@@ -671,6 +694,9 @@ func main() {
 	if quiesceLoop != nil {
 		webServer.SetBackupTrigger(quiesceLoop) // "Mentés most" → app-consistent backup via the quiesce loop
 	}
+	if mailShim != nil {
+		webServer.SetMailShim(mailShim) // settings toggle starts/stops the app-email shim at runtime
+	}
 	if assetsSyncer != nil {
 		webServer.SetAssetsSyncer(assetsSyncer)
 	}
@@ -785,6 +811,9 @@ func main() {
 		sig := <-sigCh
 		logger.Printf("[INFO] Received signal %v, shutting down...", sig)
 		cancel()
+		if mailShim != nil {
+			mailShim.Close()
+		}
 
 		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 15*time.Second)
 		defer shutdownCancel()