checkpoint: stalwart deploy, beam-design, migration scripts, config tweaks

Stalwart + Bulwark mail server deployment with OIDC, TLS cert, vault
secrets. Beam design service. Pingora config cleanup. SeaweedFS
replication fix. Kratos values tweak. Migration scripts for mbox/messages
/calendars from La Suite to Stalwart.

scripts/migrate-mbox-job.yaml

@@ -0,0 +1,57 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: migrate-mbox
+  namespace: stalwart
+spec:
+  template:
+    spec:
+      restartPolicy: Never
+      initContainers:
+        - name: export
+          image: python:3.12-slim
+          command: ["/bin/sh", "-c", "pip -q install psycopg2-binary && python3 /scripts/export-mbox.py && ls -la /tmp/mbox/"]
+          env:
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: messages-db-credentials
+                  key: password
+          volumeMounts:
+            - name: script
+              mountPath: /scripts
+            - name: mbox
+              mountPath: /tmp/mbox
+      containers:
+        - name: import
+          image: stalwartlabs/stalwart:v0.15.5
+          command:
+            - /bin/sh
+            - -c
+            - |
+              URL="http://stalwart.stalwart.svc.cluster.local:8080"
+              CREDS="admin:${ADMIN_PASSWORD}"
+
+              for mbox in /tmp/mbox/*.mbox; do
+                ACCOUNT=$(basename "$mbox" .mbox)
+                echo "=== Importing $mbox into $ACCOUNT ==="
+                stalwart-cli -u "$URL" -c "$CREDS" import messages -f mbox "$ACCOUNT" "$mbox"
+                echo ""
+              done
+
+              echo "All imports complete."
+          env:
+            - name: ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: stalwart-app-secrets
+                  key: admin-password
+          volumeMounts:
+            - name: mbox
+              mountPath: /tmp/mbox
+      volumes:
+        - name: script
+          configMap:
+            name: export-mbox-script
+        - name: mbox
+          emptyDir: {}