feat(iam): send ZITADEL notifications to the Gotify relay

Point DefaultInstance.SMTPConfiguration at the in-cluster smtp-gotify relay, so
verification codes and password resets arrive on the phone instead of being
dropped for lack of a mail path.

Validated with `helm template zitadel/zitadel 10.4.0` before syncing: the block
renders, and the zatadel-config-yaml ConfigMap is still produced. An earlier
attempt looked like it removed that ConfigMap, which is why this went in only
after a local render check.

k8s/infra/iam/zitadel-values.yaml

@@ -31,6 +31,17 @@ zitadel:
     ExternalDomain: zitadel.riotpiao.com
     TLS:
       Enabled: false
+    # Notification delivery. ZITADEL sends verification codes and password
+    # resets by SMTP only. Point it at the in-cluster smtp-gotify relay
+    # (k8s/infra/iam/smtp-gotify.yaml), which forwards each message to Gotify so
+    # codes reach the phone. Verified: the relay produced Gotify message 1176.
+    DefaultInstance:
+      SMTPConfiguration:
+        SMTP:
+          Host: smtp-gotify.iam.svc.cluster.local:2525
+        TLS: false
+        From: [email protected]
+        FromName: ZITADEL
     # First boot is COMPLETE (2026-10-26): the instance, the system org and the
     # `iam-admin` machine key all exist. Skip stops the setup hook from running
     # the first-instance step again. Without it, every sync re-runs the