MailCheap /mail deployment gateway

This folder accompanies the modified AGPL-3.0 MailCheap source. It is deployment
infrastructure, separate from the original npm scripts. Preserve LICENSE,
README, font licenses and attribution when redistributing it.

Runtime: Node >=22.12.0; verified with Node 26.10.0 / npm 11.19.1.
Install the application with npm ci and configure its .env.production.local.
Set APP_URL=https://botensten.com/mail and NEXT_PUBLIC_BASE_PATH=/mail before
building and running. Set SOURCE_URL to the source archive's public URL.

The gateway expects release-manifest.json beside gateway.mjs. Copy the example
and replace its release value with the absolute application directory. That
directory must contain package.json, the frozen node_modules install and the
private .env.production.local file. Never include that environment file in the
source archive. Configure the original S3 variables, AWS_ENDPOINT_URL_S3,
IMAGES_CDN_URL and MONGODB_URI as described in docs/deployment.txt.

Build from the app directory with the production environment exported, so a
development .env.local cannot override build-time values. One Node command is:
  node --env-file=.env.production.local /absolute/path/to/npm run build
Here /absolute/path/to/npm is npm's JavaScript entry point (the installed npm
executable resolves to it on the deployment Mac).

Run the original scripts on loopback:
  npm start -- --hostname 127.0.0.1 --port 3031
Run this gateway from its directory:
  node gateway.mjs

The gateway listens on 127.0.0.1:4191. Its existing root-site upstream is
127.0.0.1:4181. PORT, MAIL_PORT and PUBLIC_PORT can override those ports. It is
intentionally specific to botensten.com/www.botensten.com and /mail. Place the
gateway behind the owner's existing HTTPS tunnel. Preserve public Host and
HTTPS scheme. The gateway removes /community, forwards the app, serves its
source archive and restricts image access to database-registered image objects.

Create mailcheap-botensten-source.tar.gz beside the gateway, containing all app
source and this deployment folder, excluding secrets, databases, node_modules
and build output. The existing Source code footer offers that archive.

Supervise app, gateway and MongoDB separately. Keep database and signing-secret
backups private. QStash must have production credentials and public job access;
Resend must have a dedicated signed webhook. A browser challenge must not block
OAuth machine endpoints, signed jobs or signed webhooks. Keep app authentication
and signature verification active. Do not expose MongoDB publicly.

The source checkout contains docs/resend.txt and docs/deployment.txt explaining
the approved differences from upstream. The owner-specific local audit and
secret files are intentionally outside this public source distribution.
