feat(iam): deliver ZITADEL notifications through Gotify

ZITADEL sends verification codes and password resets by SMTP only, and this
cluster has no mail path. Every human user therefore sits at
verified_email = empty and can never finish a first login, at ZITADEL or at
Forgejo.

Add an smtp-gotify relay in the iam namespace: it accepts plain SMTP on :2525
and forwards each message to the existing Gotify instance, so codes arrive on
the phone through gotify/igotify instead of email.

Point DefaultInstance.SMTPConfiguration at that Service with TLS off, because
the relay speaks plain SMTP inside the cluster. The relay holds the Gotify app
token in a SOPS-encrypted Secret; values never carry the token.

k8s/argocd/secrets/smtp-gotify-secrets.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    token: ENC[AES256_GCM,data:CUJ0rUtgye71fpFz50RSDXJeG+t8Wjrm6T6jboVPbt2FVuIRSscqKg/Pc3k/L8nvLvrkYlzz1rbYu9v5NAdNF2c35AQ=,iv:tsfQ+v4qwj6H7G/O79b6m4XMWRw3mwE67f+4LjDCOoY=,tag:SLGGBYtYoF45AQstETPYZA==,type:str]
+kind: Secret
+metadata:
+    creationTimestamp: null
+    name: smtp-gotify
+    namespace: iam
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFWmU5TUxLeGU4YzUxRU9G
+            ZFR5a2hqS3huYlJtempaQ25zUkljUDJLSENrCkx0bjQ4UVF3UWpWa0t3WHQ2bkNl
+            eEp2d0dQRHJSOExIYjN4TmRTZWdQY00KLS0tIGF5enUxTmxRTHlQRUt1aTFIYTFB
+            MEJaOWd6SnhWQU1PQXdUZDJqWmp2MGsKIOOrp52+d3M8AQlMw0VSnLQ2efDtC6Ye
+            oC/TPqYi9SqYNxaHkODS2QZN9msyfRFcgUh/6ZXr8sivnpwRY8ZZtw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-27T06:24:20Z"
+    mac: ENC[AES256_GCM,data:9Jsnij+I1MhLhIPLt2hr1a6Jryf8XcAb4QAknGkX1hNEN+Z9HT5PSnPARqyhl0WTxe8813a/G0h93SJ0A419jIzZugv6zEj4STsOG4hMI8O2NniqOwiDWl+Az9SRXIQ0ahH9En7ssvEdiosIDGJSz31ufNc8FbwKnHvgWCwfK9Q=,iv:VNTOpQkDakoaCu2dG4lRbd+6AzimNZVNzggq/7C2eM8=,tag:cJI9WdnKiG3K3J4LRDqQxQ==,type:str]
+    version: 3.13.2

k8s/infra/iam/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 
 resources:
   - rbac-dashboard-rolebinding.yaml
+  - smtp-gotify.yaml
 
 # IAM provisioning is manual-only (security-sensitive).
 # Script: scripts/iam/zitadel-provision.py

k8s/infra/iam/smtp-gotify.yaml

@@ -0,0 +1,99 @@
+# SMTP -> Gotify relay for ZITADEL notifications.
+#
+# ZITADEL sends verification codes, password resets and one-time passwords by
+# SMTP only, and this cluster has no working mail path: no SMTP credentials are
+# configured for ZITADEL, and the notification table shows
+# verified_email empty for every user. Without a delivery path nobody can finish
+# a first login, at ZITADEL or at any relying party such as Forgejo.
+#
+# This relay accepts plain SMTP on :2525 and forwards every message to Gotify,
+# so codes arrive on the phone through the existing gotify/igotify setup instead
+# of email. ZITADEL then points DefaultInstance.SMTPConfiguration at this
+# Service (see k8s/infra/iam/zitadel-values.yaml).
+#
+# The Gotify token is a Secret, never a literal here.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: smtp-gotify
+  namespace: iam
+  labels:
+    app: smtp-gotify
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: smtp-gotify
+  template:
+    metadata:
+      labels:
+        app: smtp-gotify
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: smtp-gotify
+          image: quay.io/reiml/smtp-gotify:latest
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: GOTIFY_URL
+              value: "http://gotify.notifications.svc.cluster.local"
+            - name: GOTIFY_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: smtp-gotify
+                  key: token
+            - name: GOTIFY_PRIORITY
+              value: "5"
+            # ZITADEL sends "ZITADEL - Verify email" style subjects; keep them
+            # so the phone notification says what it is.
+            - name: GOTIFY_TITLE_TEMPLATE
+              value: "{{.Subject}}"
+          ports:
+            - name: smtp
+              containerPort: 2525
+              protocol: TCP
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+          readinessProbe:
+            tcpSocket:
+              port: smtp
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: smtp
+            initialDelaySeconds: 10
+            periodSeconds: 20
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: smtp-gotify
+  namespace: iam
+  labels:
+    app: smtp-gotify
+spec:
+  type: ClusterIP
+  selector:
+    app: smtp-gotify
+  ports:
+    - name: smtp
+      port: 2525
+      targetPort: smtp
+      protocol: TCP

k8s/infra/iam/zitadel-values.yaml

@@ -31,6 +31,22 @@ zitadel:
     ExternalDomain: zitadel.riotpiao.com
     TLS:
       Enabled: false
+    # Notification delivery. ZITADEL speaks SMTP only, and this cluster has no
+    # mail path: without it every verification and password-reset message is
+    # dropped, so nobody can finish a first login. Point SMTP at the in-cluster
+    # smtp-gotify relay (k8s/infra/iam/smtp-gotify.yaml), which forwards each
+    # message to Gotify so codes arrive on the phone.
+    #
+    # TLS is false because the relay speaks plain SMTP inside the cluster and
+    # never leaves it. Host and credentials stay out of this file: no auth is
+    # needed, and the relay holds the Gotify token in the smtp-gotify Secret.
+    DefaultInstance:
+      SMTPConfiguration:
+        SMTP:
+          Host: smtp-gotify.iam.svc.cluster.local:2525
+        TLS: false
+        From: [email protected]
+        FromName: ZITADEL
 
     # First boot is COMPLETE (2026-10-26): the instance, the system org and the
     # `iam-admin` machine key all exist. Skip stops the setup hook from running