Fix Forgejo mailer ESO field mapping and token bootstrap env

Map OpenBao key PASSWD to Secret MAILER_PASSWD so ExternalSecret syncs
against the live coulombcore path. Allow non-interactive bootstrap via
OPENBAO_TOKEN_FILE for make forgejo-openbao-eso-token-apply.

manifests/forgejo-mailer-externalsecret.yaml

@@ -1,7 +1,7 @@
 # Forgejo IONOS SMTP password from OpenBao (RAIL-HO-WP-0005-T06).
 #
 # OpenBao path (platform KV v2): workloads/forgejo/forgejo-mailer
-# Field: MAILER_PASSWD (optional SMTP_USER for non-Helm consumers)
+# Field: PASSWD (OpenBao key); synced to Secret key MAILER_PASSWD for Helm
 #
 # Prereqs on railiance01:
 #   - External Secrets Operator (make eso-deploy)
@@ -27,4 +27,4 @@ spec:
     - secretKey: MAILER_PASSWD
       remoteRef:
         key: workloads/forgejo/forgejo-mailer
-        property: MAILER_PASSWD
+        property: PASSWD

tools/forgejo-openbao-eso-token-apply.sh

@@ -22,8 +22,21 @@ fi
 
 echo "OpenBao addr: $BAO_ADDR"
 echo "Policy: $POLICY_NAME"
-read -r -s -p "OpenBao operator token (coulombcore / bao.coulomb.social): " BAO_TOKEN
-echo >&2
+
+if [[ -n "${BAO_TOKEN:-}" ]]; then
+  :
+elif [[ -n "${OPENBAO_TOKEN_FILE:-}" && -f "${OPENBAO_TOKEN_FILE}" ]]; then
+  BAO_TOKEN="$(head -n 1 "${OPENBAO_TOKEN_FILE}")"
+else
+  read -r -s -p "OpenBao operator token (coulombcore / bao.coulomb.social): " BAO_TOKEN
+  echo >&2
+fi
+
+if [[ -z "${BAO_TOKEN:-}" ]]; then
+  echo "ERROR: empty OpenBao token" >&2
+  exit 1
+fi
+
 export BAO_ADDR BAO_TOKEN
 
 health="$(curl -fsS "$BAO_ADDR/v1/sys/health")"