checkpoint: stalwart deploy, beam-design, migration scripts, config tweaks

Stalwart + Bulwark mail server deployment with OIDC, TLS cert, vault
secrets. Beam design service. Pingora config cleanup. SeaweedFS
replication fix. Kratos values tweak. Migration scripts for mbox/messages
/calendars from La Suite to Stalwart.

base/devtools/beam-design.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: beam-design
+  namespace: devtools
+  labels:
+    app: beam-design
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: beam-design
+  template:
+    metadata:
+      labels:
+        app: beam-design
+    spec:
+      containers:
+        - name: beam-design
+          image: src.sunbeam.pt/studio/beam-ui:latest
+          ports:
+            - containerPort: 8080
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          securityContext:
+            runAsUser: 65534
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: beam-design
+  namespace: devtools
+  labels:
+    app: beam-design
+spec:
+  selector:
+    app: beam-design
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP