Fix Forgejo mailer ESO field mapping and token bootstrap env

Map OpenBao key PASSWD to Secret MAILER_PASSWD so ExternalSecret syncs
against the live coulombcore path. Allow non-interactive bootstrap via
OPENBAO_TOKEN_FILE for make forgejo-openbao-eso-token-apply.

manifests/forgejo-mailer-externalsecret.yaml

@@ -1,7 +1,7 @@
 # Forgejo IONOS SMTP password from OpenBao (RAIL-HO-WP-0005-T06).
 #
 # OpenBao path (platform KV v2): workloads/forgejo/forgejo-mailer
-# Field: MAILER_PASSWD (optional SMTP_USER for non-Helm consumers)
+# Field: PASSWD (OpenBao key); synced to Secret key MAILER_PASSWD for Helm
 #
 # Prereqs on railiance01:
 #   - External Secrets Operator (make eso-deploy)
@@ -27,4 +27,4 @@ spec:
     - secretKey: MAILER_PASSWD
       remoteRef:
         key: workloads/forgejo/forgejo-mailer
-        property: MAILER_PASSWD
+        property: PASSWD