docs: REPORT — live end-to-end validation results (v0.88.0)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

REPORT.md

@@ -57,10 +57,33 @@ documented v2 path.)
 
 Test count: **+~17** controller test functions (mailrelay 9, stacks/mailenv 8); suite remains green.
 
-## Deployment & live validation
-See the cross-repo end-to-end result in `felhom.eu/REPORT.md`. Controller v0.88.0 deploys to guest 9201 via the
-golden/bootstrap mechanism; the controller container must be joined to the app `traefik-public` network so apps
-resolve the shim by the DNS name `felhom-controller`.
+## Deployment & live validation — DONE (2026-06-29)
+- **Built** `felhom-controller:0.88.0` on 192.168.0.180; **deployed** to guest 9201 via the golden/bootstrap
+  mechanism (`docker pull` → `/etc/felhom-controller-image` → restart bootstrap). `docker ps`: `…:0.88.0 Up
+  (healthy)`. The controller container is **already on `traefik-public`** (and bridge), so apps resolve the
+  shim by `felhom-controller` — no network change needed.
+- **Global toggle via the REAL endpoint:** `POST /settings/app-email` (in-guest, the exact form the UI submits,
+  with session cookie + `_csrf`) → HTTP 200; controller logged `[mailrelay] app-email shim ON
+  (host=felhom-controller plain=[::]:2525 tls=[::]:2465)` and persisted `app_email.enabled=true` in
+  settings.json.
+- **End-to-end happy path (real pipeline, real Resend send):** a raw MIME message with an **inline CID image**,
+  From `vaultwarden@felhom.eu`, sent through the running shim from a throwaway container on `traefik-public`
+  (`app → shim → hub → Resend`). Result: `MAIL 250 / RCPT 250 / DATA 250 "OK: queued"`. Shim log:
+  `message relayed (from="vaultwarden@felhom.eu" rcpts=1 bytes=789 hub=200)`; hub log:
+  `/api/v1/mail: relayed for demo-felhom`. The DATA-250 is returned only after the hub→Resend leg accepted
+  (queued) the message. Recipient = the operator's own address; **inbox arrival is the operator's final
+  confirmation** (Resend returned 250/queued for the verified `felhom.eu` domain, which the spike established
+  delivers with inline image intact). The Resend key never touched the guest and is in no committed file.
+- **Security gate (live):** the same send From `evil@notfelhom.example` → `DATA 550 "5.7.1 sender address not
+  permitted"` and **no `/api/v1/mail` call reached the hub** (rejected before forward — scenario B confirmed live).
+- **Method note:** the relay pipeline (the new, previously-unproven code) is validated against the live Resend
+  account. The catalog `smtp_mapping` → per-app env injection is unit-tested (`TestSMTPEnv_*` incl. the
+  Vaultwarden mapping); deploying the Vaultwarden app and clicking its admin "send test email" would
+  additionally exercise that app's own SMTP client (already spike-proven) — recommended as the final manual
+  smoke once the catalog sync has the new templates.
+
+> **Demo box state:** global app-email left **ON** on guest 9201 (the validated working state). No customer apps
+> have the per-app toggle on, so nothing else changed.
 
 ## Observations
 - **Mealie uses plaintext (NONE), not STARTTLS** — Mealie has no accept-invalid-cert option, so STARTTLS to the