fix(mail): unbreak join@ registration when the Mailu cert lapses (#129)

Registration has been dead since 2026-09-13. `ssh join@bbs.profullstack.com`
creates the account, then fails at the confirmation step with "couldn't email
the code" and disconnects, so nobody can finish signing up.

Cause: Caddy owns ACME for mail.profullstack.com and renewed on 2026-08-14
(valid to Nov 12), but Mailu went on serving the certificate it loaded at
container start (Jun 15 -> Sep 13). When that lapsed, the STARTTLS handshake
from internal/mail started failing verification and every transactional send
died with it -- confirmation codes, signup notifications, credential mail.
Reproduced against production; 25/465/993 all still present the expired cert
while :443 serves the renewed one.

Three things let a single stale certificate take registration down:

- setup.sh installed the refresher and enabled its *timer*, but never ran it.
  `systemctl enable --now <timer>` starts the timer, not the service, so a
  redeploy left a stale cert in place (and did nothing at all if the timer was
  never scheduled). The news and IRC sections already run theirs at provision
  time; the Mailu section now does too, which is what repairs the live host.

- refresh-certs.sh only compared files, so a copy whose reload silently failed
  left a fresh cert on disk and an expiring one on the wire -- invisible. It now
  reads back what the relay actually serves, forces a reload when that disagrees
  with /certs, refuses to copy a source cert that is itself expired, and no
  longer swallows the `docker compose restart` failure. It restarts `front`
  alone, the only container that mounts ./certs.

- internal/mail verified the relay's certificate even on loopback, where there
  is nothing to intercept. It now skips verification for a loopback relay (the
  reasoning docs/mail.md already applies to the plaintext Dovecot hand-off) and
  gains AGENTBBS_SMTP_SERVERNAME, mirroring AGENTBBS_MAIL_SMTP_SERVERNAME, so
  the documented 127.0.0.1:25 config can verify against the mail host instead of
  an IP literal. A non-loopback relay is still verified. Errors are wrapped with
  the address and the failing stage so the next failure is one journal line to
  diagnose rather than nine days of silence.

Tests cover the envelope, the unreachable-relay message, and both halves of the
TLS decision: a loopback relay with an expired cert delivers, a non-loopback one
with the same cert is refused.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/credentials.md

@@ -130,6 +130,7 @@ on any failure.
 | `AGENTBBS_SET_IRC_SUDO` | `1` | chat — invoke the helper via `sudo` (set `0` if the BBS already runs as root, e.g. in tests) |
 | `AGENTBBS_SMTP_HOST` / `_FROM` | unset | **sending** all of the above emails (required to actually send) |
 | `AGENTBBS_SMTP_PORT` / `_USER` / `_PASS` | `587` / unset / unset | SMTP submission (STARTTLS) |
+| `AGENTBBS_SMTP_SERVERNAME` | unset (= `_HOST`) | name STARTTLS certs are verified against when the relay is dialled on loopback; verification is skipped entirely for a loopback relay |
 
 ## Two SMTP paths (and why one is `:25`)
 

docs/mail.md

@@ -147,9 +147,37 @@ them at the local Mailu relay so codes actually send:
 AGENTBBS_SMTP_HOST=127.0.0.1
 AGENTBBS_SMTP_PORT=25
 AGENTBBS_SMTP_FROM=bbs@bbs.profullstack.com
+AGENTBBS_SMTP_SERVERNAME=mail.profullstack.com   # set by setup.sh
 # user/pass omitted: the co-located relay accepts local submission unauthenticated
 ```
 
+`AGENTBBS_SMTP_SERVERNAME` is the name STARTTLS certificates are verified
+against when it differs from the dialled host — the relay answers on
+`127.0.0.1` but presents a cert for the mail host. It mirrors
+`AGENTBBS_MAIL_SMTP_SERVERNAME` on the mailbox gateway and `setup.sh` sets it
+whenever the Mailu stack is enabled.
+
+On a **loopback** relay the sender skips certificate verification outright. The
+connection never leaves the host, so there is nothing to intercept — and tying
+`join@` registration to an on-box cert being both name-matched and unexpired is
+precisely what broke signups for nine days in September 2026 (see below).
+
+### When confirmation codes stop sending
+
+`join@` reporting *"couldn't email the code"* means `internal/mail` could not
+hand the message to the relay. The error is in the journal
+(`journalctl -u agentbbs -g "send code"`), and it now names the address and the
+failing stage. The usual cause is the mail host's TLS cert: Caddy owns ACME for
+`mail.$DOMAIN` and `deploy/mailu/refresh-certs.sh` copies it into Mailu, but
+Mailu keeps serving whatever it loaded at container start. Check what is
+actually on the wire rather than what is on disk:
+
+```bash
+printf 'QUIT\r\n' | openssl s_client -quiet -starttls smtp \
+  -connect 127.0.0.1:25 -servername mail.$DOMAIN 2>&1 | grep -i notAfter
+sudo /usr/local/bin/agentbbs-mailu-certs   # copies + reloads; loud on failure
+```
+
 ## Provisioning member mailboxes
 
 Provisioning is automatic at `join@` verification. To create or backfill by hand: