checkpoint: stalwart deploy, beam-design, migration scripts, config tweaks

Stalwart + Bulwark mail server deployment with OIDC, TLS cert, vault
secrets. Beam design service. Pingora config cleanup. SeaweedFS
replication fix. Kratos values tweak. Migration scripts for mbox/messages
/calendars from La Suite to Stalwart.

overlays/local/kustomization.yaml

@@ -20,6 +20,7 @@ resources:
   - ../../base/lasuite
   - ../../base/media
   - ../../base/devtools
+  - ../../base/stalwart
   - ../../base/vso
 
 images:

overlays/production/kustomization.yaml

@@ -17,6 +17,7 @@ resources:
   - ../../base/lasuite
   - ../../base/media
   - ../../base/devtools
+  - ../../base/stalwart
   - ../../base/vso
   - ../../base/monitoring
   - ../../base/matrix
@@ -107,12 +108,21 @@ patches:
   # SeaweedFS volume: expand PVC to 600 Gi
   - path: patch-seaweedfs-volume-size.yaml
 
-  # MTA-in: bind port 25 to the host for inbound email delivery
+  # Stalwart: bind SMTP (25), submission (587), and IMAPS (993) to the host
   - patch: |
       - op: add
         path: /spec/template/spec/containers/0/ports/0/hostPort
         value: 25
+      - op: add
+        path: /spec/template/spec/containers/0/ports/1/hostPort
+        value: 587
+      - op: add
+        path: /spec/template/spec/containers/0/ports/2/hostPort
+        value: 465
+      - op: add
+        path: /spec/template/spec/containers/0/ports/4/hostPort
+        value: 993
     target:
       kind: Deployment
-      name: messages-mta-in
-      namespace: lasuite
+      name: stalwart
+      namespace: stalwart