Wire Forgejo SMTP password from OpenBao via External Secrets

Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the
synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.

manifests/forgejo-mailer-externalsecret.yaml

@@ -0,0 +1,30 @@
+# Forgejo IONOS SMTP password from OpenBao (RAIL-HO-WP-0005-T06).
+#
+# OpenBao path (platform KV v2): workloads/forgejo/forgejo-mailer
+# Field: MAILER_PASSWD (optional SMTP_USER for non-Helm consumers)
+#
+# Prereqs on railiance01:
+#   - External Secrets Operator (make eso-deploy)
+#   - ClusterSecretStore openbao-forgejo (railiance-platform openbao-secretstore)
+#   - OpenBao role external-secrets-forgejo (make openbao-configure-external-secrets-forgejo)
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: forgejo-mailer
+  namespace: forgejo
+  labels:
+    app.kubernetes.io/name: forgejo
+    app.kubernetes.io/part-of: railiance-apps
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-forgejo
+  target:
+    name: forgejo-mailer
+    creationPolicy: Owner
+  data:
+    - secretKey: MAILER_PASSWD
+      remoteRef:
+        key: workloads/forgejo/forgejo-mailer
+        property: MAILER_PASSWD