v0.89.0: app-email plaintext-only listener (:2526) + split-From mapping

Gap 1: third shim listener :2526, plaintext, does NOT advertise STARTTLS (TLSConfig
nil) — for opportunistic-STARTTLS clients with no cert-skip (cal.com, nextcloud).
Gap 2: SMTPMapping tls_mode (picks port 2525/2526/2465) + from_domain_var (split
local-part + domain for nextcloud's MAIL_FROM_ADDRESS/MAIL_DOMAIN). Default keeps
existing apps on 2525. Hub untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/stacks/mailenv.go

@@ -47,11 +47,20 @@ func (m *Manager) smtpEnv(meta *Metadata, appEmailEnabled bool) []string {
 	if security == "" {
 		security = "starttls"
 	}
+	port := shimPortForTLSMode(sm.TLSMode)
 
 	out := []string{
 		fmt.Sprintf("%s=%s", sm.HostVar, host),
-		fmt.Sprintf("%s=%s", sm.PortVar, "2525"),
-		fmt.Sprintf("%s=%s@%s", sm.FromVar, local, fromDomain),
+		fmt.Sprintf("%s=%s", sm.PortVar, port),
+	}
+	// From: single full-address var (default) or split local-part + domain (nextcloud-style).
+	if sm.FromDomainVar != "" {
+		out = append(out,
+			fmt.Sprintf("%s=%s", sm.FromVar, local),
+			fmt.Sprintf("%s=%s", sm.FromDomainVar, fromDomain),
+		)
+	} else {
+		out = append(out, fmt.Sprintf("%s=%s@%s", sm.FromVar, local, fromDomain))
 	}
 	if sm.SecurityVar != "" {
 		out = append(out, fmt.Sprintf("%s=%s", sm.SecurityVar, security))
@@ -67,6 +76,20 @@ func (m *Manager) smtpEnv(meta *Metadata, appEmailEnabled bool) []string {
 	return out
 }
 
+// shimPortForTLSMode maps a mapping's tls_mode to the shim listener port. Default (empty/"starttls")
+// keeps existing apps on :2525 (plaintext + STARTTLS); "plaintext" → :2526 (STARTTLS NOT advertised,
+// for opportunistic-upgrade clients with no cert-skip); "implicit-tls" → :2465.
+func shimPortForTLSMode(mode string) string {
+	switch mode {
+	case "plaintext":
+		return "2526"
+	case "implicit-tls":
+		return "2465"
+	default: // "" or "starttls"
+		return "2525"
+	}
+}
+
 // fromDisplayName picks the From display name: the household-set name (settings) wins,
 // else the app's display name.
 func (m *Manager) fromDisplayName(meta *Metadata) string {