Complete EMAIL-WP-0004 transactional invitation mail delivery.

Ship the railiance01 deploy package (OpenBao/ESO custody, NetworkPolicy,
probes), provider failure classification and suppression, T04 unit and live
proof, and non-secret NK-WP-0024 hand-back evidence. Workplan finished.

deploy/k8s/railiance/configmap.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: email-connect-config
+  namespace: email-connect
+  labels:
+    app.kubernetes.io/name: email-connect
+    app.kubernetes.io/part-of: email-connect
+data:
+  # Non-secret runtime shape only. SMTP auth and the caller ingest token stay
+  # in OpenBao → ExternalSecret (see externalsecret.yaml).
+  EMAIL_CONNECT_HTTP_PORT: "8080"
+  EMAIL_CONNECT_DATABASE_PATH: "/data/email-connect.db"
+  EMAIL_CONNECT_SMTP_HOST: "smtp.ionos.de"
+  EMAIL_CONNECT_SMTP_PORT: "587"
+  # Public portal base used in invitation and verification links.
+  # Matches the live user-engine Ingress host on railiance01 (nip.io until a
+  # coulomb.social alias is cut over). Update when the public hostname changes.
+  EMAIL_CONNECT_PORTAL_URL: "https://users.92-205-62-239.nip.io"
+  # Envelope From — interim identity matches the live forgejo IONOS SMTP lane
+  # (forgejo@coulomb.social) used to seed CCR-2026-0010. Switch to a dedicated
+  # noreply@ mailbox when that credential is minted separately.
+  EMAIL_CONNECT_SENDER: "forgejo@coulomb.social"