fix(devtools): stabilize Penpot MCP, fix S3 creds, OIDC registration

MCP server:
- Replace vite build --watch + livePreview with static vite preview
  (watch mode was reloading the plugin iframe, killing WebSocket)
- Bake WS_URI at Docker build time for production WebSocket URL
- Add server-side application-level keepalive messages every 25s
- Add client-side auto-reconnect with exponential backoff
- Set Pingora route timeout to 86400s for WebSocket idle tolerance

Penpot:
- Add AWS_ACCESS_KEY_ID/SECRET env vars for S3 SDK compatibility
- Set S3 region to satisfy AWS SDK credential chain
- Enable OIDC registration (disable-registration blocks OIDC signup)
- Fix frontend port (8080 not 80)
- Add penpot bucket to seaweedfs-buckets init job

base/ingress/pingora-config.yaml

@@ -155,8 +155,32 @@ data:
 
     [[routes]]
     host_prefix = "mail"
-    # Caddy is the unified entry point — proxies /api/, /admin/, /static/, /oidc/ internally.
-    backend     = "http://messages-frontend.lasuite.svc.cluster.local:80"
+    backend     = "http://bulwark.stalwart.svc.cluster.local:80"
+
+      # JMAP protocol (Bulwark ↔ Stalwart)
+      [[routes.paths]]
+      prefix  = "/jmap"
+      backend = "http://stalwart.stalwart.svc.cluster.local:8080"
+
+      # Well-known service discovery (autoconfig, caldav, carddav, etc.)
+      [[routes.paths]]
+      prefix  = "/.well-known/"
+      backend = "http://stalwart.stalwart.svc.cluster.local:8080"
+
+      # OAuth2/OIDC authorization callback
+      [[routes.paths]]
+      prefix  = "/authorize"
+      backend = "http://stalwart.stalwart.svc.cluster.local:8080"
+
+      # Stalwart admin + API
+      [[routes.paths]]
+      prefix  = "/api"
+      backend = "http://stalwart.stalwart.svc.cluster.local:8080"
+
+      # JMAP WebSocket
+      [[routes.paths]]
+      prefix  = "/ws"
+      backend = "http://stalwart.stalwart.svc.cluster.local:8080"
 
     [[routes]]
     host_prefix = "messages"
@@ -182,18 +206,25 @@ data:
     websocket   = true
 
     [[routes]]
-    host_prefix = "mcp-designer"
-    backend     = "http://penpot-mcp.devtools.svc.cluster.local:4401"
-    websocket   = true
+    host_prefix  = "mcp-designer"
+    backend      = "http://penpot-mcp.devtools.svc.cluster.local:4400"
+    websocket    = true
+    timeout_secs = 86400
 
       [[routes.paths]]
-      prefix       = "/"
+      prefix       = "/mcp"
       backend      = "http://penpot-mcp.devtools.svc.cluster.local:4401"
       auth_request = "http://hydra-public.ory.svc.cluster.local:4444/userinfo"
 
       [[routes.paths]]
-      prefix  = "/ws"
-      backend = "http://penpot-mcp.devtools.svc.cluster.local:4402"
+      prefix       = "/sse"
+      backend      = "http://penpot-mcp.devtools.svc.cluster.local:4401"
+      auth_request = "http://hydra-public.ory.svc.cluster.local:4444/userinfo"
+
+      [[routes.paths]]
+      prefix       = "/ws"
+      backend      = "http://penpot-mcp.devtools.svc.cluster.local:4402"
+      timeout_secs = 86400
 
     [[routes]]
     host_prefix = "src"
@@ -280,43 +311,21 @@ data:
 
     [[routes]]
     host_prefix = "cal"
-    backend     = "http://calendars-frontend.lasuite.svc.cluster.local:80"
-
-      [[routes.paths]]
-      prefix  = "/api/"
-      backend = "http://calendars-backend.lasuite.svc.cluster.local:80"
-
-      [[routes.paths]]
-      prefix  = "/admin/"
-      backend = "http://calendars-backend.lasuite.svc.cluster.local:80"
-
-      [[routes.paths]]
-      prefix  = "/static/"
-      backend = "http://calendars-backend.lasuite.svc.cluster.local:80"
+    # Default: redirect to unified Bulwark calendar UI.
+    redirect    = "https://mail.DOMAIN_SUFFIX/calendar"
 
+      # CalDAV protocol — external calendar clients connect here.
       [[routes.paths]]
       prefix  = "/caldav"
-      backend = "http://calendars-backend.lasuite.svc.cluster.local:80"
+      backend = "http://stalwart.stalwart.svc.cluster.local:8080"
 
       [[routes.paths]]
       prefix  = "/.well-known/caldav"
-      backend = "http://calendars-backend.lasuite.svc.cluster.local:80"
+      backend = "http://stalwart.stalwart.svc.cluster.local:8080"
 
       [[routes.paths]]
-      prefix  = "/rsvp/"
-      backend = "http://calendars-backend.lasuite.svc.cluster.local:80"
-
-      [[routes.paths]]
-      prefix  = "/ical/"
-      backend = "http://calendars-backend.lasuite.svc.cluster.local:80"
-
-      [[routes.paths]]
-      prefix  = "/external_api/"
-      backend = "http://calendars-backend.lasuite.svc.cluster.local:80"
-
-      [[routes.paths]]
-      prefix  = "/__"
-      backend = "http://calendars-backend.lasuite.svc.cluster.local:80"
+      prefix  = "/.well-known/carddav"
+      backend = "http://stalwart.stalwart.svc.cluster.local:8080"
 
     [[routes]]
     host_prefix = "projects"
@@ -392,6 +401,21 @@ data:
     host_prefix = "build"
     backend     = "buildkitd.build.svc.cluster.local:1234"
 
+    # SMTP inbound: port 25 → Stalwart for mail delivery.
+    [smtp]
+    listen  = "0.0.0.0:25"
+    backend = "stalwart.stalwart.svc.cluster.local:25"
+
+    # SMTP submission: port 587 → Stalwart for authenticated sending.
+    [smtp-submission]
+    listen  = "0.0.0.0:587"
+    backend = "stalwart.stalwart.svc.cluster.local:587"
+
+    # IMAPS: port 993 → Stalwart for desktop/mobile email clients.
+    [imaps]
+    listen  = "0.0.0.0:993"
+    backend = "stalwart.stalwart.svc.cluster.local:993"
+
     # SSH TCP passthrough: port 22 → Gitea SSH pod (headless service → pod:2222).
     [ssh]
     listen  = "0.0.0.0:22"