SmallWorlds v1.2.40

A large release: the administrative surface is closed off, mail becomes opt-in,
and the shell installer's local (LAN) path works again.

Read before adopting

• Mail is now opt-in, and system notification no longer routes through it.
  Transactional mail is separated from the optional mail server. If you relied
  on alert email arriving via Stalwart, check where your notifications go now.
• Administrative interfaces are no longer publicly reachable. Argo CD,
  Grafana, SSH and the Kubernetes API are closed off, the Keycloak admin console
  is taken off the public internet, and the master realm is closed to it as well.
  If you administer your cluster through public URLs today, establish your
  private path before bumping to this release.
• Keycloak realm changes. Passwords are removed from the realm and the admin
  gains a second factor; recovery codes are reachable at login and issued at
  onboarding; invitation onboarding is fixed and gains a printable delivery path.
  The passkey policy is documented and the earlier "passwordless" claim corrected.
• The node patches itself automatically, and lateral movement to the
  databases is blocked by policy.

Installing on a LAN machine works again

smallworlds-init.sh with target local had stopped working entirely: the
bootstrap became an execution payload that refuses to run without release-pinned
verified assets and a profile that owns the node, and only the Bootstrap Launcher
ever supplied those. The shell path now builds the same payload from the same
declared inputs — verifying every download against
docs/releases/bootstrap-inputs/ — caches it, and rebuilds it whenever the
bootstrap script itself moves on.

It also pins the Argo CD root application to an exact overlay commit, which
it resolves before touching the machine. Consequence worth knowing: your overlay
repository must already exist and carry its first commit. If it does not, the
installer now says so immediately and names prepare-community-repo.sh, rather
than failing twenty minutes later inside Argo CD.

The pod archive is addressable

pod was missing from the in-cluster DNS override in both bootstraps and from
the generated hosts entries, and neither hostname generator knew the app — so a
selected pod gateway kept the project's own domain on its Ingress no matter what
domain the operator chose. All three now carry it.

The Immich exporter reaches the gateway through its Service rather than the
public hostname. A nightly job that never leaves the node should not depend on
public DNS resolving inside the cluster, nor on a certificate the pod's trust
store accepts — on a LAN deployment neither holds. https://pod.<domain>
remains what it always was: the door for members' devices.

Fixes for console-installed clusters

• The cluster secrets never included the backup Garage instance, whose chart
  runs with secret.create=false. Without it that instance never starts, and
  every backup producer — barman, Velero, pv-backup, the Nextcloud file copy,
  the pod archive — has nowhere to write. Such an installation looks healthy
  right up to the moment somebody needs a Recovery Point.
• The protection inventory still reported the Immich library as covered by a
  pv-backup rclone job removed in docs/adr/0047. It now reports the
  append-only pod archive, with no offsite copy, and Nextcloud's filesystem and
  bucket datasets are listed separately, since they have different producers and
  different schedules.
• The console's copy of the hostname map did not know about the Keycloak admin
  Ingress added by this release's hardening work, so a console-rendered overlay
  left the admin console on the project's domain.

Also

Staging: the runner can compare against a branch other than main, deploy a
chosen subset of apps, and configure the VM's location and server type; it
tolerates Traefik's CRD lag and deploys garage-backup, without which Keycloak
never finishes syncing. Realm import fixed — a subflow cannot have two parents.

Full Changelog: v1.2.39...v1.2.40