v2026.10.5 — mail can sign with its own SMTP credentials

Mail can sign with its own SMTP credentials, separately from each process's S3 credentials (PR #46). Cut from v2026.10.4 with only this change.

• DY_SMTP_ACCESS_KEY_ID / DY_SMTP_SECRET_ACCESS_KEY, when both are set, are what SMTP signs with. Otherwise it uses the process's AWS_* pair, as before. Half a pair, or a blank, is "mail not configured", with the reason printed, and the record carries on.
• compose.yaml: ingest takes the pair from DY_SMTP_*; web takes its own from DY_WEB_SMTP_*, never the instance's.
• The nightly dump unit also blanks the new pair.

Deploying it with all four lines empty changes nothing. No migration (schema 34).

🤖 Generated with Claude Code