Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.
Wire forgejo@coulomb.social via smtp.ionos.com:587 in Helm values and add SOPS-encrypted mailbox password overlay for forgejo-deploy.
Pin chart to 12.5.0 because 12.6+ calls `gitea config edit-ini`, which Forgejo 11 lacks. Ingress targets forgejo-gitea-http (Helm release naming). Smoke test uses GET for /v2/ registry challenge (HEAD returns 405).
