fix(deploy): pass SES config through to the app stack

The stack env is assembled from Gitea repo secrets by the deploy
workflows' `env_data` block — there is no .env file on the host for the
app stack. SES was in neither, so `MailService` came up unconfigured on
every deployment and, with NODE_ENV=production killing the stdout dev
fallback, every notification and renewal aviso failed.

Wire SES_REGION / SES_FROM / SES_FROM_NAME / SES_ACCESS_KEY /
SES_SECRET_KEY / SES_CONFIGURATION_SET / NOTIFICATION_ADMIN_EMAILS
through both galactus and cubex. No `_GALACTUS` suffix: one SES identity
serves every deployment.

Kept out of the required-secrets preflight — mail is not needed to boot,
and failing a deploy over it would be wrong. Preflight warns instead,
since the failure is otherwise invisible until someone clicks "Ejecutar".

Also corrects the comments added in the previous commit, which claimed
these belonged in a host env file rather than in CI secrets.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/galactus/jorgecuadros-app.compose.yml

@@ -73,13 +73,16 @@ services:
       S3_BUCKET: ${S3_BUCKET:-jorgecuadros-documents}
       MINIO_ROOT_USER: ${MINIO_ROOT_USER:?MINIO_ROOT_USER must be set}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD must be set}
-      # Outbound mail (SES). Runtime config, never baked into the image and
-      # never a CI secret — the build does not send mail, this container does.
+      # Outbound mail (SES). Runtime config — read at container boot, never
+      # baked into the image; the build does not send mail, this container
+      # does. Values arrive the same way DATABASE_URL does: as Gitea repo
+      # secrets, injected into this stack's env by the `env_data` block of
+      # .gitea/workflows/deploy-galactus.yml.
+      #
       # The image sets NODE_ENV=production, which disables MailService's
       # stdout dev fallback: leave these blank and every notification and
       # renewal aviso fails with "El envío de correo no está configurado."
-      # rather than silently going nowhere. Values live in this stack's env
-      # file on galactus (deploy/.env.prod), same as DATABASE_URL.
+      # rather than silently going nowhere.
       SES_REGION: ${SES_REGION:-}
       SES_FROM: ${SES_FROM:-}
       SES_FROM_NAME: ${SES_FROM_NAME:-}

deploy/jorgecuadros-app.env.example

@@ -34,9 +34,13 @@ MINIO_ROOT_USER=jc_minio
 MINIO_ROOT_PASSWORD=CHANGE_ME
 
 # --- Outbound mail (Amazon SES) ----------------------------------------------
-# Belongs HERE, in the stack's env file on the host — not in Gitea Actions
-# secrets. The build never sends mail; the running container does, and it reads
-# these at boot (apps/api/src/mail/mail.service.ts).
+# NOTE: for the Portainer-deployed stacks these do NOT come from a file on the
+# host — the deploy workflows build the stack env from Gitea repo secrets (see
+# the `env_data` blocks in .gitea/workflows/deploy*.yml). This file documents
+# the full variable set and is what you fill in for a hand-run stack.
+#
+# Either way they are RUNTIME config, read at container boot
+# (apps/api/src/mail/mail.service.ts) — never baked into the image.
 #
 # The production image sets NODE_ENV=production, which turns OFF the stdout dev
 # fallback. Leaving these blank does not silently swallow mail — every send