fix(iam): make the SMTP->Gotify relay actually push

Two defects in the first cut, both silent from the sender's side because the
relay answers 250 either way:

- GOTIFY_URL needs a trailing slash; without it the push has no path.
- GOTIFY_TITLE_TEMPLATE referenced .Subject, which the relay does not expose,
  so template execution failed.

The relay's default title already carries the subject, so drop the template.

Also register the SOPS file in secret-generator.yaml: the sops-secrets app only
renders files listed there, so the Secret was never created and the relay sat in
CreateContainerConfigError.

k8s/argocd/secrets/secret-generator.yaml

@@ -35,6 +35,7 @@ files:
     - pi-sandbox-secrets.enc.yaml
     - etcd-defrag-creds.enc.yaml
     - zitadel-masterkey.enc.yaml
+    - smtp-gotify-secrets.enc.yaml
     # Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
     # owns it. Without this, the chart re-generates the keypair on every render,
     # which changes checksum/secret-login-service-key and leaves both Zitadel