Map OpenBao key PASSWD to Secret MAILER_PASSWD so ExternalSecret syncs
against the live coulombcore path. Allow non-interactive bootstrap via
OPENBAO_TOKEN_FILE for make forgejo-openbao-eso-token-apply.
Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the
synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.