config: point to new Stalwart backend (emailcore.src-advisory.com)

- JMAP_SERVER_URL: stalwart.sandbox.vnc.de → emailcore.src-advisory.com
- Updated Electron defaults, deploy secrets example, and e2e tests
- SMTP server (emailcore-svc.src-advisory.com) is handled by Stalwart
  internally via JMAP EmailSubmission — no frontend changes needed

deploy/k8s/overlays/dev/secret.example.yaml

@@ -8,7 +8,7 @@ metadata:
 type: Opaque
 stringData:
   # Core — connect to Stalwart over JMAP
-  JMAP_SERVER_URL: "https://stalwart.sandbox.vnc.de"
+  JMAP_SERVER_URL: "https://emailcore.src-advisory.com"
   SESSION_SECRET: "REPLACE_ME__openssl_rand_base64_32"
   # Branding (theme defaults to VNClagoon in code; these set name + logo)
   APP_NAME: "VNCmail+"

deploy/k8s/overlays/prod/image-tag/kustomization.yaml

@@ -1,12 +1,11 @@
-# Owned by CI (the bump-prod job in .gitlab-ci.yml), not by hand — same
-# reasoning as overlays/dev/image-tag/. Starts pointed at an obviously-fake
-# tag on purpose: nothing has been promoted yet, and vncmail-prod's ArgoCD
-# Application has manual sync anyway, so this being "wrong" doesn't deploy
-# anything wrong — it just means there's nothing to sync until a real
-# `git push` to main updates it.
+# Owned by CI (bump-prod job in .gitlab-ci.yml) - regenerated every
+# push to main. Do not hand-edit; edits here get overwritten. Bumping
+# this is NOT the same as deploying it - vncmail-prod's ArgoCD
+# Application has manual sync, see the note in the parent
+# kustomization.yaml.
 apiVersion: kustomize.config.k8s.io/v1alpha1
 kind: Component
 images:
   - name: vncmail-plus
     newName: registry.gitlab.vnc.biz/gitlab-instance-b9b5cf2f/vncmail-plus
-    newTag: not-yet-promoted
+    newTag: sha-cfdd091d

e2e/electron-live-sandbox.spec.ts

@@ -16,7 +16,7 @@ import path from 'node:path';
 //      real JMAP server round trip works end-to-end, without ever using or
 //      guessing a real account's credentials.
 const projectRoot = path.resolve(__dirname, '..');
-const SANDBOX_URL = 'https://stalwart.sandbox.vnc.de';
+const SANDBOX_URL = 'https://emailcore.src-advisory.com';
 
 test.describe('Electron desktop shell - live sandbox connectivity', () => {
   let electronApp: ElectronApplication;

e2e/electron-smoke.spec.ts

@@ -36,7 +36,7 @@ test.describe('Electron desktop shell', () => {
         // needing a reachable JMAP server just to prove the login screen
         // renders - any non-empty JMAP_SERVER_URL is enough to reach
         // "env-managed" state and serve the normal app shell.
-        JMAP_SERVER_URL: 'https://stalwart.sandbox.vnc.de',
+        JMAP_SERVER_URL: 'https://emailcore.src-advisory.com',
         SESSION_SECRET: 'electron-smoke-test-not-for-production',
         NODE_ENV: 'production',
       },

electron/main.ts

@@ -96,7 +96,7 @@ function getServerDataDirs(): Record<string, string> {
  */
 function getDesktopDefaults(): Record<string, string> {
   return {
-    JMAP_SERVER_URL: "https://stalwart.sandbox.vnc.de",
+    JMAP_SERVER_URL: "https://emailcore.src-advisory.com",
     APP_NAME: "VNCmail+",
     APP_SHORT_NAME: "VNCmail+",
     LOGIN_LOGO_LIGHT_URL: "/branding/SRC_Symbol.png",