chore(vnc): bootstrap VNCmail+ fork — vnc/ layer + Vercel runbook

Fork of bulwarkmail/webmail for deploy on Vercel as project vncmail-plus.
Adds vnc/ customization layer (branding, overrides, VNC-CHANGES log),
Vercel env template, and VNCMAIL-SETUP.md runbook. No upstream files touched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vnc/vercel.env.template

@@ -0,0 +1,38 @@
+# ────────────────────────────────────────────────────────────────
+# VNCmail+ · Vercel environment variables
+# Paste these into Vercel → Project "vncmail-plus" → Settings →
+# Environment Variables. Do NOT commit real secret values.
+# All vars are read at RUNTIME (no rebuild needed to change them),
+# except NEXT_PUBLIC_BASE_PATH.
+# ────────────────────────────────────────────────────────────────
+
+# --- Core: connect to Stalwart over JMAP ---
+# Setting this skips the setup wizard and uses env-managed config
+# (important on Vercel, where the wizard's disk config is not persisted).
+JMAP_SERVER_URL=https://stalwart.sandbox.vnc.de
+
+# --- Session encryption (mark as "Sensitive" in Vercel) ---
+# Generate with:  openssl rand -base64 32
+SESSION_SECRET=__PASTE_GENERATED_SECRET__
+
+# --- Branding ---
+APP_NAME=VNCmail+
+APP_SHORT_NAME=VNCmail+
+LOGIN_COMPANY_NAME=VNC
+
+# --- Quiet the periodic update check (avoids disk/network on serverless) ---
+BULWARK_UPDATE_CHECK=off
+
+# ────────────────────────────────────────────────────────────────
+# Intentionally NOT set (defaults are correct for a Vercel deploy):
+#   OAUTH_ENABLED           → unset = basic auth via Stalwart (chosen)
+#   SETTINGS_SYNC_ENABLED   → unset = off (needs a persistent disk; skip on Vercel)
+#   BULWARK_TELEMETRY       → unset = off (opt-in only)
+#   NEXT_PUBLIC_BASE_PATH   → unset = deploy at domain root
+#
+# Add later if needed:
+#   OAUTH_ENABLED / OAUTH_ISSUER_URL / OAUTH_CLIENT_ID / OAUTH_CLIENT_SECRET
+#     → SSO via vncdirectory (follow-up, not first deploy)
+#   APP_LOGO_LIGHT_URL / LOGIN_LOGO_LIGHT_URL / FAVICON_URL / PWA_ICON_URL
+#     → VNC brand assets (see vnc/branding/)
+# ────────────────────────────────────────────────────────────────