fix(stalwart): TLS cert %{file} macros, HTTPS egress for webadmin

Stalwart v0.15.5 requires %{file:path}% macros to read cert/key
from disk — bare paths were treated as literal content, causing
"No certificates found" errors.

Added HTTPS egress to NetworkPolicy so Stalwart can download the
webadmin bundle and spam/geo databases from GitHub/CDN on boot.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/network-policies/stalwart.yaml

@@ -36,6 +36,10 @@ spec:
           protocol: UDP
         - port: 53
           protocol: TCP
+    # HTTPS out — webadmin bundle + spam model downloads from GitHub
+    - ports:
+        - port: 443
+          protocol: TCP
     # No outbound SMTP — internal-only for now.
     # To add SCW TEM relay later:
     #   - ports:

infra/k8s/stalwart/stalwart.yaml

@@ -62,8 +62,8 @@ data:
     store = "rocksdb"
 
     [certificate.default]
-    cert = "/opt/stalwart/tls/tls.crt"
-    private-key = "/opt/stalwart/tls/tls.key"
+    cert = "%{file:/opt/stalwart/tls/tls.crt}%"
+    private-key = "%{file:/opt/stalwart/tls/tls.key}%"
 ---
 apiVersion: apps/v1
 kind: Deployment