Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.