chore: keep all agentbbs services on latest software (#69)

* ci: add mailu-update workflow to keep the mail stack current

The deploy/mailu compose stack pins the floating series tags
(ghcr.io/mailu/*:2024.06); patch releases within the series only land when
someone runs `docker compose pull`, so the box drifts behind on security fixes.

Add a scheduled (weekly) + on-demand workflow that SSHes to the droplet
(reusing deploy.yml's DEPLOY_* secrets), backs up DKIM keys + the admin DB,
pulls the latest images for the pinned series, recreates the containers, and
health-checks the Mailu front on 127.0.0.1:8080. Shares deploy.yml's
concurrency group so it never races a code deploy. Stays within the pinned
series on purpose — crossing to a future series stays a deliberate PR.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore: bump Forgejo to 11.0.15 + add Dependabot to keep deps current

Audit of every version pin in the repo: Ergo (2.18.0), Go (1.26 → latest
patch via setup-go), the Ubuntu pod base (24.04 LTS), and the GitHub Action
majors are all already current. Only Forgejo was stale — bump 11.0.1 →
11.0.15 (latest patch of the 11.x LTS line; a 15.x major stays a deliberate,
tested upgrade because of DB migrations).

Add .github/dependabot.yml so github-actions, Go modules, and the Docker
image tags (Mailu compose + pod Containerfile) get review-gated update PRs
weekly. Shell-string pins (FORGEJO_VERSION/ERGO_VERSION in setup.sh) can't be
watched by Dependabot; noted inline. Mailu runtime patch level is handled by
the mailu-update workflow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* mailu: document RECIPIENT_DELIMITER=+ in mailu.env.example

Plus-addressing (chovy+tag@ -> chovy@) is a hard prerequisite for qaaas.dev's
packages/mail but was missing from the example, so tagged mail bounces as an
unknown recipient until an operator sets it by hand. Add it with a note that it
governs DELIVERY only, not login (Mailu auths the exact address; base <name>@
is the single login and already receives all +tagged mail).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

.github/dependabot.yml

@@ -0,0 +1,42 @@
+# Keep agentbbs's pinned dependencies current automatically. Dependabot opens
+# (review-gated) PRs when a newer version ships — nothing auto-merges, so a bad
+# bump can't silently reach production.
+#
+# Coverage:
+#   - github-actions : the action pins in .github/workflows/* (checkout, setup-go…)
+#   - gomod          : Go module dependencies (go.mod / go.sum)
+#   - docker         : image tags in the Mailu compose stack and the pod Containerfile
+#
+# NOT covered (Dependabot can't watch shell-string pins): FORGEJO_VERSION and
+# ERGO_VERSION in setup.sh — bump those by hand, or switch to Renovate (which can
+# watch them via a custom regex manager). The Mailu *runtime* patch level is kept
+# current separately by .github/workflows/mailu-update.yml.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      go-modules:
+        patterns: ["*"]
+
+  # Mailu compose stack — bumps ghcr.io/mailu/* image tags.
+  - package-ecosystem: docker
+    directory: /deploy/mailu
+    schedule:
+      interval: weekly
+
+  # Pod base image (docker.io/library/ubuntu).
+  - package-ecosystem: docker
+    directory: /pods
+    schedule:
+      interval: weekly