checkpoint: stalwart deploy, beam-design, migration scripts, config tweaks

Stalwart + Bulwark mail server deployment with OIDC, TLS cert, vault
secrets. Beam design service. Pingora config cleanup. SeaweedFS
replication fix. Kratos values tweak. Migration scripts for mbox/messages
/calendars from La Suite to Stalwart.

base/stalwart/oidc-client.yaml

@@ -0,0 +1,24 @@
+# Stalwart OIDC client — registered with Hydra for SSO login.
+# Hydra Maester creates K8s Secret "oidc-stalwart" in the stalwart namespace
+# with CLIENT_ID and CLIENT_SECRET keys.
+# DOMAIN_SUFFIX is replaced by sed at deploy time.
+apiVersion: hydra.ory.sh/v1alpha1
+kind: OAuth2Client
+metadata:
+  name: stalwart
+  namespace: stalwart
+spec:
+  clientName: Mail
+  grantTypes:
+    - authorization_code
+    - refresh_token
+  responseTypes:
+    - code
+  scope: openid email profile
+  redirectUris:
+    - https://mail.DOMAIN_SUFFIX/authorize/code
+  postLogoutRedirectUris:
+    - https://mail.DOMAIN_SUFFIX
+  tokenEndpointAuthMethod: client_secret_post
+  secretName: oidc-stalwart
+  skipConsent: true