[ExtraToast]

Closes #2645

Outlook.com, Hotmail, Live and MSN refuse 157.173.115.164 with S3150. Until Microsoft lifts the block, mail for any domain whose MX ends in .olc.protection.outlook.com goes through Brevo's SMTP relay; every other domain keeps going direct. Matching on the MX instead of a domain list catches every country variant (hotmail.nl, live.be, outlook.de and so on).

• infra/stalwart/apply.sh: reconcile_relay adds a Relay route (smtp-relay.brevo.com:465, implicit TLS, certificates checked) and a routing rule when relay.login and relay.key are in secret/platform/mail, then reloads settings. Without them it removes the rule and the route. It reloads only when the rule changes.
• platform/bootstrap/secrets.sh --only mail: asks for the Brevo SMTP login and key, checks them with an SMTP login at Brevo, and offers the Stalwart restart as for mailboxes.
• platform/bootstrap/mail.sh: a tenth stage says whether the relay is on and walks through authenticating esa-blueshell.nl in Brevo. Until Brevo has authenticated the domain, it signs as itself and our p=reject DMARC policy rejects the relayed mail, so the stage counts that as a failure while the relay is on.
• Docs: the Vault key notes, the bootstrap README and the DNS README (Brevo's records are added by hand; Stalwart does not own them).

Tested on a throwaway Stalwart v0.16.27 with the sidecar image built from this branch

• With the login present the sidecar created the route and the rule; a second run changed nothing and did not reload.
• hotmail.com and outlook.com mail went to the relay (an SMTP sink with AUTH and implicit TLS); hotmail.com's MTA-STS policy did not interfere. gmail.com mail went direct.
• A self-signed relay certificate is refused, as it should be in production.
• With the login removed the sidecar deleted the rule and the route, and hotmail.com mail went direct again after the reload, without a restart.

Caveat

Bounces for relayed mail land in Brevo, not in bounce@, so the api does not see them while the relay is on.

[github-actions]

Changes

Bucket	Files	Added	Removed
platform	6	██████████ 134	░ 6
total	6	+134	−6

No production or test lines added.

Coverage

	Statements	Branches	Functions	Lines
api	77.06%	71.52%	66.22%	79.18%
main 77d4acd	77.06%	71.52%	66.22%	79.18%
Δ	0.00	0.00	0.00	0.00
frontend	92.94%	88.41%	90.62%	93.52%
main 77d4acd	92.95%	88.41%	90.64%	93.54%
Δ	-0.01	0.00	-0.02	-0.02
imaging	100.00%	100.00%	100.00%	100.00%
main 77d4acd	100.00%	100.00%	100.00%	100.00%
Δ	0.00	0.00	0.00	0.00

Coverage falls below main. The ratchet only turns one way: cover what this pull request adds, or say in the description why the number goes down.

Patch coverage: this pull request changes no line that coverage measures.

[ExtraToast]

Not needed: Microsoft mitigated the S3150 block on 157.173.115.164, so mail to Outlook.com goes direct again.