feat(stalwart): fallback-admin via K8s secret for reliable auth

Stalwart's --init only runs when config.toml is absent, but ours
is mounted from a ConfigMap so no admin account was ever created.
Use the fallback-admin config with %{env:ADMIN_SECRET}% referencing
a stalwart-admin K8s secret. This survives pod restarts without
depending on RocksDB-stored credentials.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/stalwart/stalwart.yaml

@@ -61,6 +61,10 @@ data:
     type = "internal"
     store = "rocksdb"
 
+    [authentication.fallback-admin]
+    user = "admin"
+    secret = "%{env:ADMIN_SECRET}%"
+
     [certificate.default]
     cert = "%{file:/opt/stalwart/tls/tls.crt}%"
     private-key = "%{file:/opt/stalwart/tls/tls.key}%"
@@ -91,6 +95,12 @@ spec:
       containers:
         - name: stalwart
           image: stalwartlabs/stalwart:latest
+          env:
+            - name: ADMIN_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: stalwart-admin
+                  key: password
           ports:
             - containerPort: 25
               name: smtp