fix(deploy): requireTLS for SMTP relay + bridge network for docker-compose

- mailer.js: add requireTLS to force STARTTLS before AUTH on internal relay
- docker-compose.yml: use network_mode:bridge to reach 172.17.0.1:2587 SMTP relay
  and switch to ${SMTP_HOST:-172.17.0.1}/${SMTP_PORT:-2587} defaults

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -3,6 +3,7 @@ services:
     image: morsequest:latest
     container_name: morsequest
     restart: unless-stopped
+    network_mode: bridge
     ports:
       - "127.0.0.1:3004:8080"
     volumes:
@@ -10,8 +11,8 @@ services:
     environment:
       PORT: "8080"
       NODE_ENV: production
-      SMTP_HOST: mail.keylinkit.net
-      SMTP_PORT: "587"
+      SMTP_HOST: 172.17.0.1
+      SMTP_PORT: "2587"
       SMTP_USER: ${SMTP_USER}
       SMTP_PASS: ${SMTP_PASS}
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}

server/mailer.js

@@ -17,10 +17,11 @@ if (SMTP_HOST && SMTP_USER && SMTP_PASS) {
     port: SMTP_PORT,
     secure: SMTP_PORT === 465,
     auth: { user: SMTP_USER, pass: SMTP_PASS },
+    requireTLS: true,  // force STARTTLS before AUTH
     connectionTimeout: 10_000,
     greetingTimeout: 10_000,
     socketTimeout: 15_000,
-    tls: { rejectUnauthorized: false }, // tunnel relay cert is for mail.keylinkit.net, not 172.17.0.1
+    tls: { rejectUnauthorized: false }, // relay cert is for mail.keylinkit.net, not 172.17.0.1
   })
   console.log(`[mailer] SMTP configured: ${SMTP_HOST}:${SMTP_PORT}`)
 } else {