feat(supabase): add Google/Apple OAuth and fueltide.io-branded email flows

Enables the auth providers and transactional email flows the self-hosted
Supabase was missing compared to the cloud instance:

- GoTrue now accepts Google and Apple OAuth (web flow); Apple client-secret
  JWT is signed fresh on every activation from the SOPS-stored .p8 so
  there's no 6-month rotation ritual.
- SMTP points at mail.cloonar.com:587 with SASL auth via a new `supabase`
  LDAP account; a `noreply@fueltide.io` mailAlias lets that account send
  as the fueltide.io address.
- rspamd on mail.cloonar.com gets a per-domain DKIM key for fueltide.io
  (selector `default`) so outbound mail is signed.
- MAILER_AUTOCONFIRM is off so signup confirmation + password reset
  actually go through email.
- SITE_URL + URI_ALLOW_LIST point at app.fueltide.io / stage so links in
  emails and OAuth redirects land in the right app.

FUELTIDE_AUTH_SETUP.md documents the manual steps (LDAP entries, SOPS
additions, DNS records, Google/Apple console setup) that must be completed
before merging.

hosts/mail/configuration.nix

@@ -10,6 +10,7 @@
     ./modules/openldap.nix
     ./modules/dovecot.nix
     ./modules/postfix.nix
+    ./modules/dkim-fueltide.nix
 
     ./utils/modules/borgbackup.nix
     ./utils/modules/promtail

hosts/mail/modules/dkim-fueltide.nix

@@ -0,0 +1,28 @@
+{ config, pkgs, ... }:
+
+{
+  sops.secrets.rspamd-dkim-fueltide-io-key = {
+    owner = "rspamd";
+    group = "rspamd";
+    mode = "0400";
+  };
+
+  # rspamd's dkim_signing module in rspamd.nix picks up per-domain keys from
+  # /var/lib/rspamd/dkim/$domain.$selector.key. This one-shot drops the
+  # fueltide.io key into place before rspamd starts.
+  systemd.services.rspamd-dkim-fueltide-setup = {
+    description = "Install fueltide.io DKIM key into rspamd";
+    wantedBy = [ "multi-user.target" ];
+    before = [ "rspamd.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      install -d -o rspamd -g rspamd -m 0750 /var/lib/rspamd/dkim
+      install -o rspamd -g rspamd -m 0400 \
+        ${config.sops.secrets.rspamd-dkim-fueltide-io-key.path} \
+        /var/lib/rspamd/dkim/fueltide.io.default.key
+    '';
+  };
+}