Prepare an isolated private mail service before public activation #5288

🤖 Generated by the Agentic Engineer

Part of #5030. The maintainer has requested completion of private mail and the remaining alert migration.

The mail service needs a reproducible, isolated starting point before any mailbox or public listener is enabled. Prepare a pinned Stalwart Community deployment on the existing platform, with its administrator credential generated in-cluster and stored in OpenBao. Keep the component disabled by default, and keep the preparation mode limited to management within the cluster. No temporary administrator credential may be generated into logs.

Acceptance criteria:

• The normal production and local renders contain no mail service while the component is disabled.
• Enabling the preparation component renders a restricted workload, persistent storage, a drain-safe disruption budget, narrow networking and the existing generated-credential/OpenBao delivery pattern.
• The pinned upstream server starts with the committed datastore configuration and a supplied fixture credential; no credential is generated into logs, and preparation mode opens no mail listener.
• Static manifest validation and relevant security checks cover the enabled component as well as the disabled production render.
• The runbook distinguishes preparation from activation and records the remaining DNS, recipient, outbound delivery, reply authentication and restore proofs owned by Company Email infrastructure and service notifications #5030.

New dependency: Stalwart Community v0.16.27, reviewed from its exact release and source. Its community implementation is available under AGPL-3.0-only; no Enterprise feature or paid service is proposed.

Priority: High. Effort: Medium. This is the first delivery slice of the explicitly requested mail capability; it establishes the safe deployment path without claiming inbox delivery.