Prod: load SMTP env via envFrom secretRef (flat, paste-proof)

Replace the six nested secretKeyRef env entries with a single
'envFrom: - secretRef: { name: verso-smtp, optional: true }' in both the
standalone app manifest and the prod workflow. Avoids the deep nesting that
tripped strict server-side decoding, and is simpler to edit. The secret's keys
must now be named exactly like the env vars (OVERLEAF_EMAIL_*).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server-ce/k8s/verso-prod-app.yaml

@@ -77,46 +77,15 @@ spec:
             # them). Public self-registration is also off (CE default).
             - name: OVERLEAF_ENABLE_PROJECT_PYTHON_VENV
               value: "true"
-            # SMTP for password-reset / invite emails. Values come from the
-            # 'verso-smtp' Secret; all optional so the app boots before the
-            # secret exists (email stays off until OVERLEAF_EMAIL_FROM_ADDRESS
-            # is present).
-            - name: OVERLEAF_EMAIL_FROM_ADDRESS
-              valueFrom:
-                secretKeyRef:
-                  name: verso-smtp
-                  key: from-address
-                  optional: true
-            - name: OVERLEAF_EMAIL_SMTP_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: verso-smtp
-                  key: smtp-host
-                  optional: true
-            - name: OVERLEAF_EMAIL_SMTP_PORT
-              valueFrom:
-                secretKeyRef:
-                  name: verso-smtp
-                  key: smtp-port
-                  optional: true
-            - name: OVERLEAF_EMAIL_SMTP_SECURE
-              valueFrom:
-                secretKeyRef:
-                  name: verso-smtp
-                  key: smtp-secure
-                  optional: true
-            - name: OVERLEAF_EMAIL_SMTP_USER
-              valueFrom:
-                secretKeyRef:
-                  name: verso-smtp
-                  key: smtp-user
-                  optional: true
-            - name: OVERLEAF_EMAIL_SMTP_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: verso-smtp
-                  key: smtp-pass
-                  optional: true
+          # SMTP for password-reset / invite emails. All OVERLEAF_EMAIL_* vars
+          # are loaded from the optional 'verso-smtp' Secret — its keys must be
+          # named exactly like these env vars (see the kubectl create secret
+          # command in the docs). Optional, so the app still boots before the
+          # secret exists; email just stays off.
+          envFrom:
+            - secretRef:
+                name: verso-smtp
+                optional: true
           volumeMounts:
             - name: verso-data
               mountPath: /var/lib/overleaf/data