fix(deploy): requireTLS for SMTP relay + bridge network for docker-compose

- mailer.js: add requireTLS to force STARTTLS before AUTH on internal relay
- docker-compose.yml: use network_mode:bridge to reach 172.17.0.1:2587 SMTP relay
  and switch to ${SMTP_HOST:-172.17.0.1}/${SMTP_PORT:-2587} defaults

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/mailer.js

@@ -17,10 +17,11 @@ if (SMTP_HOST && SMTP_USER && SMTP_PASS) {
     port: SMTP_PORT,
     secure: SMTP_PORT === 465,
     auth: { user: SMTP_USER, pass: SMTP_PASS },
+    requireTLS: true,  // force STARTTLS before AUTH
     connectionTimeout: 10_000,
     greetingTimeout: 10_000,
     socketTimeout: 15_000,
-    tls: { rejectUnauthorized: false }, // tunnel relay cert is for mail.keylinkit.net, not 172.17.0.1
+    tls: { rejectUnauthorized: false }, // relay cert is for mail.keylinkit.net, not 172.17.0.1
   })
   console.log(`[mailer] SMTP configured: ${SMTP_HOST}:${SMTP_PORT}`)
 } else {