Record IONOS SMTP decision and Forgejo mailer deployment

Document forgejo@coulomb.social on IONOS smtp.ionos.com:587; mailer live on
railiance01 via railiance-apps Helm. T06 password-reset test remains open.

docs/forgejo-production-decisions.md

@@ -13,7 +13,7 @@ Operator input: 2026-07-03
 | 2b | Deployment pattern | `gitea-charts/gitea` **12.5.0** Helm + Forgejo image; CNPG `forgejo-db` in `railiance-platform`; Makefile in `railiance-apps` | **decided** | Chart 12.6+ requires Gitea 1.26 `config edit-ini` (incompatible with Forgejo 11); see `railiance-apps/docs/forgejo-on-railiance01.md` |
 | 2c | Live deploy | Forgejo pod + ingress + TLS on railiance01 | **done** (2026-07-03) | `make forgejo-smoke` → HTTP 200 + OCI `/v2/` 401 challenge; cert `forgejo-tls` Ready |
 | 3 | Gitea during transition | `gitea.coulomb.social` on coulombcore remains canonical **until** Forgejo restore/migration drills pass; then read-only mirror | unchanged | Per `RAIL-HO-WP-0005` safety contract |
-| 4 | SMTP / password reset | TBD | open | — |
+| 4 | SMTP / password reset | **IONOS** SMTP; sender `forgejo@coulomb.social`; mailer deployed on railiance01 | **done** (2026-07-07) | `railiance-apps` Helm rev 5; T06 password-reset test still open — see § SMTP below |
 | 5 | Package registry scope | TBD (container images first assumed) | open | — |
 | 6 | Actions runner model | **In-cluster** on railiance01: `forgejo-runner` Deployment + DinD (`railiance01-build-01`) | **done** (2026-07-03) | Runner 2/2 Ready; coulombcore host runner disabled; `image-build` probe pushed OCI image via org secrets |
 | 7 | Backup target + retention | TBD | open | — |
@@ -52,12 +52,44 @@ remains canonical for git remotes until migration drills pass.
 - Runners and image-build CI are proven; first repo migration pilot
   (`glas-harness`) documents git/SSH/CI routing in
   `docs/forgejo-repo-migration-pilot-glas-harness.md`.
-- Remaining blockers for production cutover: SMTP, backup, cutover mode, operator
-  SSH identity on Forgejo, and production repo migration (`RAIL-HO-WP-0005-T11`).
+- Remaining blockers for production cutover: SMTP **mailbox + T06 test** (provider
+  decided: IONOS), backup, cutover mode, and production repo migration
+  (`RAIL-HO-WP-0005-T11`).
+
+## SMTP decision (IONOS) — 2026-07-07
+
+**Provider:** IONOS mail for `coulomb.social` and subdomains (operator owns DNS zone
+via IONOS; mailboxes provisioned in IONOS control panel).
+
+**Recommended Forgejo mailer settings** (non-secret; password in
+`railiance-apps/helm/forgejo-secrets.sops.yaml`):
+
+| Field | Value |
+| --- | --- |
+| `MAILER_TYPE` | `smtp` |
+| `HOST` | `smtp.ionos.com:587` (EU accounts may use `smtp.ionos.de:587`) |
+| `IS_TLS_ENABLED` | `true` (STARTTLS on 587) |
+| `FROM` | `forgejo@coulomb.social` (or dedicated `noreply@…` mailbox) |
+| `USER` | full mailbox address (same as `FROM` unless using a shared relay mailbox) |
+| `PASSWD` | IONOS mailbox password — SOPS only, never Git plaintext |
+
+**Operator setup checklist:**
+
+1. Create mailbox in IONOS (e.g. `forgejo@coulomb.social`).
+2. Confirm SPF includes IONOS (`include:_spf-eu.ionos.com` or current IONOS
+   guidance for the zone).
+3. Enable DKIM in IONOS for `coulomb.social` if offered.
+4. Store mailbox password in `helm/forgejo-secrets.sops.yaml` under
+   `gitea.config.mailer.PASSWD`; redeploy Forgejo.
+5. T06 gate: trigger password reset for a controlled non-admin test account;
+   confirm delivery and link works.
+
+**Implementation:** `railiance-apps/docs/forgejo-on-railiance01.md` (SMTP section).
 
 ## Open decisions (need operator input)
 
-1. SMTP provider, sender address, and SPF/DKIM alignment for `@coulomb.social`
+1. ~~SMTP provider~~ — **done: IONOS** (`forgejo@coulomb.social` deployed); remaining:
+   T06 password-reset delivery test
 2. Package types beyond OCI at launch (npm, PyPI, Helm, …)
 3. Actions runner: in-cluster ephemeral vs long-lived pod vs host runner
 4. Backup destination and restore cadence