Wire Forgejo SMTP password from OpenBao via External Secrets

Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the
synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.

helm/forgejo-values.yaml

@@ -35,6 +35,13 @@ gitea:
     username: forgejo_admin
     email: admin@coulomb.social
     passwordMode: initialOnlyRequireReset
+  # Mailer password from OpenBao via ExternalSecret forgejo-mailer (not Helm/SOPS).
+  additionalConfigFromEnvs:
+    - name: GITEA__mailer__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: forgejo-mailer
+          key: MAILER_PASSWD
   config:
     database:
       DB_TYPE: postgres