fix(iam): make the SMTP->Gotify relay actually push

Two defects in the first cut, both silent from the sender's side because the
relay answers 250 either way:

- GOTIFY_URL needs a trailing slash; without it the push has no path.
- GOTIFY_TITLE_TEMPLATE referenced .Subject, which the relay does not expose,
  so template execution failed.

The relay's default title already carries the subject, so drop the template.

Also register the SOPS file in secret-generator.yaml: the sops-secrets app only
renders files listed there, so the Secret was never created and the relay sat in
CreateContainerConfigError.

k8s/infra/iam/smtp-gotify.yaml

@@ -42,7 +42,7 @@ spec:
           imagePullPolicy: IfNotPresent
           env:
             - name: GOTIFY_URL
-              value: "http://gotify.notifications.svc.cluster.local"
+              value: "http://gotify.notifications.svc.cluster.local/"
             - name: GOTIFY_TOKEN
               valueFrom:
                 secretKeyRef:
@@ -50,10 +50,10 @@ spec:
                   key: token
             - name: GOTIFY_PRIORITY
               value: "5"
-            # ZITADEL sends "ZITADEL - Verify email" style subjects; keep them
-            # so the phone notification says what it is.
-            - name: GOTIFY_TITLE_TEMPLATE
-              value: "{{.Subject}}"
+            # No title template: the relay's default title already carries
+            # the mail subject, and a wrong template field fails the push
+            # silently (the SMTP side still answers 250, so the sender thinks
+            # the message was delivered).
           ports:
             - name: smtp
               containerPort: 2525