Enable IONOS SMTP mailer for Forgejo on railiance01

Wire forgejo@coulomb.social via smtp.ionos.com:587 in Helm values and add
SOPS-encrypted mailbox password overlay for forgejo-deploy.

helm/forgejo-secrets.sops.yaml

@@ -0,0 +1,28 @@
+gitea:
+    admin:
+        password: ENC[AES256_GCM,data:D4vjZzWdKb8FgCXcRp+Ndjya1yFqB995,iv:WzOzUMTu4TBcpEgYFkz186CnmSpmmQ+Jqnz8I4ZpVVw=,tag:hHbXEhBGfNhr63mNF/HTBA==,type:str]
+    config:
+        database:
+            PASSWD: ENC[AES256_GCM,data:oHp70axstRWh4YPYeKNpt8a8eejgFjyw6azdhZG1WqA=,iv:B9acXzEmJ2tGzkIkG2X/RsrdSGwzV/dgOI3Hn8/J9is=,tag:WHs/yEIZ7upffCXaOUfPuQ==,type:str]
+        mailer:
+            PASSWD: ENC[AES256_GCM,data:W3+t8Hgn4/yPAvVWYa/Gkn4=,iv:NrL0TD3lTQWfVIzxbjJi9FrZrMmI6s4Bpo8zvMKVHLI=,tag:pBvK4wrhOOWUDI2wtg7MIQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsbjJqRG9uOUZiU0RjSnVm
+            aE9ZaitSdjdjb0RNU2pzNGlsTHV5K2I1MGlBCms2RFRPelA1ODBoVTZidFZnOC9u
+            ZllVazZDRmZjQzg4L0E3QXpJWDFIUGcKLS0tIFViM0czZDR6dUFTRmZXRUQ0RW9w
+            aEF0RDMzb0o1YzduZHIxUGNBdVRnOGMKjDu/B39gqkT2JJ/7NGbFqmyUPtGAf3ST
+            sUNhOgGXQRs6576QSiUEzO8Prio/lnFPM96boMgXv4+Gt2dcPmXyoA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-07T00:41:12Z"
+    mac: ENC[AES256_GCM,data:8TM3EOv3yhYfh6QTTcD2AJK1y77JJKygwoJUMULN3q3A+b/RefpXs6+h66wn13P9EvQu9FTZg0kwijLUOCktuBPfaAiz00+BK9PFtt5UsDA9g/qUVA5EUxpmq0vRzDv1njhomwmI/f9pMbKiXRvXpkXxhpMeRx6XN0D4itCEMvI=,iv:RlicLXVU7kQgfc6bM2wAvyAB8zAMX3G8ZPeToJ73g14=,tag:Det/rkDaw8LqJNqZlkGKkw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

helm/forgejo-secrets.sops.yaml.template

@@ -1,5 +1,5 @@
 # Encrypt as helm/forgejo-secrets.sops.yaml before production deploy.
-# Contains database PASSWD and admin password consumed by the gitea chart.
+# Contains database PASSWD, admin password, and IONOS SMTP mailbox password.
 #
 # gitea:
 #   admin:
@@ -7,9 +7,13 @@
 #   config:
 #     database:
 #       PASSWD: <same as forgejo-db-credentials>
+#     mailer:
+#       PASSWD: <IONOS mailbox password for forgejo@coulomb.social>
 gitea:
   admin:
     password: REPLACE_WITH_ADMIN_PASSWORD
   config:
     database:
-      PASSWD: REPLACE_WITH_DB_PASSWORD
+      PASSWD: REPLACE_WITH_DB_PASSWORD
+    mailer:
+      PASSWD: REPLACE_WITH_IONOS_MAILBOX_PASSWORD

helm/forgejo-values.yaml

@@ -49,5 +49,12 @@ gitea:
       DISABLE_SSH: false
     service:
       DISABLE_REGISTRATION: true
+    mailer:
+      ENABLED: true
+      FROM: forgejo@coulomb.social
+      MAILER_TYPE: smtp
+      HOST: smtp.ionos.com:587
+      IS_TLS_ENABLED: true
+      USER: forgejo@coulomb.social
     actions:
       ENABLED: true