Prod: load SMTP env via envFrom secretRef (flat, paste-proof)

Replace the six nested secretKeyRef env entries with a single
'envFrom: - secretRef: { name: verso-smtp, optional: true }' in both the
standalone app manifest and the prod workflow. Avoids the deep nesting that
tripped strict server-side decoding, and is simpler to edit. The secret's keys
must now be named exactly like the env vars (OVERLEAF_EMAIL_*).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy-verso-prod.yml

@@ -329,46 +329,15 @@ jobs:
                       # (CE default): admin creates accounts / sends invites.
                       - name: OVERLEAF_ENABLE_PROJECT_PYTHON_VENV
                         value: "true"
-                      # SMTP for password-reset / invite emails. Values come from
-                      # the 'verso-smtp' Secret; all optional so the app boots
-                      # before the secret exists (email stays off until
-                      # OVERLEAF_EMAIL_FROM_ADDRESS is present).
-                      - name: OVERLEAF_EMAIL_FROM_ADDRESS
-                        valueFrom:
-                          secretKeyRef:
-                            name: verso-smtp
-                            key: from-address
-                            optional: true
-                      - name: OVERLEAF_EMAIL_SMTP_HOST
-                        valueFrom:
-                          secretKeyRef:
-                            name: verso-smtp
-                            key: smtp-host
-                            optional: true
-                      - name: OVERLEAF_EMAIL_SMTP_PORT
-                        valueFrom:
-                          secretKeyRef:
-                            name: verso-smtp
-                            key: smtp-port
-                            optional: true
-                      - name: OVERLEAF_EMAIL_SMTP_SECURE
-                        valueFrom:
-                          secretKeyRef:
-                            name: verso-smtp
-                            key: smtp-secure
-                            optional: true
-                      - name: OVERLEAF_EMAIL_SMTP_USER
-                        valueFrom:
-                          secretKeyRef:
-                            name: verso-smtp
-                            key: smtp-user
-                            optional: true
-                      - name: OVERLEAF_EMAIL_SMTP_PASS
-                        valueFrom:
-                          secretKeyRef:
-                            name: verso-smtp
-                            key: smtp-pass
-                            optional: true
+                      # (SMTP email vars are loaded below via envFrom.)
+                    # SMTP for password-reset / invite emails. All
+                    # OVERLEAF_EMAIL_* vars come from the optional 'verso-smtp'
+                    # Secret (its keys must be named exactly like those env
+                    # vars). Optional, so the app boots before the secret exists.
+                    envFrom:
+                      - secretRef:
+                          name: verso-smtp
+                          optional: true
                     volumeMounts:
                       - name: verso-data
                         mountPath: /var/lib/overleaf/data