feat(email): SMTP mailer behind the EmailService seam (EMAIL_PROVIDER=smtp); Resend stays the hosted default (#1746)

SmtpEmailService (nodemailer 9.0.5, exact-pinned) behind the existing EmailService seam. Provider resolution: EMAIL_PROVIDER wins, else RESEND_API_KEY selects Resend (hosted byte-identical), else SMTP_HOST selects SMTP. From header is built exactly like the Resend service after #1956 (no 'via <app>', fromAddress honored, platform-sender retry). STARTTLS is required by default (requireTLS) with SMTP_REQUIRE_TLS=false as an explicit opt-out for a plaintext LAN relay. Docs, env examples and the generated extension registry updated.

.env.docker.example

@@ -39,3 +39,17 @@ NEXT_PUBLIC_SELF_HOSTED=true
 # Defaults to NEXT_PUBLIC_SUPABASE_URL with https:// replaced by wss://
 # (http:// by ws://). Set only if Realtime is served from another origin.
 # NEXT_PUBLIC_SUPABASE_WS_URL=wss://your-project.supabase.co
+
+# Optional: outbound email (invoices, reminders). Pick one provider.
+# 1. Resend (what hosted runs):
+# RESEND_API_KEY=
+# RESEND_FROM_EMAIL=
+# 2. Your own SMTP relay (Swedish mail provider, M365/Workspace relay, Postfix):
+# EMAIL_PROVIDER=smtp
+# SMTP_HOST=
+# SMTP_PORT=587
+# SMTP_SECURE=false          # true = implicit TLS on 465, false = STARTTLS required (set SMTP_REQUIRE_TLS=false only for a plaintext LAN relay)
+# SMTP_USER=
+# SMTP_PASS=
+# SMTP_FROM_EMAIL=
+# SMTP_REQUIRE_TLS=true      # false only for a plaintext relay on a trusted LAN