Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.
Wire forgejo@coulomb.social via smtp.ionos.com:587 in Helm values and add SOPS-encrypted mailbox password overlay for forgejo-deploy.