Invite a friend; handle field shows the domain; system mail fixes

- Invitations: each user can invite two friends by email (sign-up works
  through the link even while registration is closed); admin-editable
  template, subject and sender.
- Invitation sender defaults to the system-mail From address, which the
  SMTP account is allowed to send as (was postmaster@APP_DOMAIN, refused
  with 553 when the two differ).
- Sign-in, sign-up and forgot-password fields show the fixed
  @domain after the typed name; the registration status reports it.
- System mail gets a Date header; the invitation's plain-text part keeps
  its paragraphs and line breaks.
- SMTP EHLO uses SMTP_HELO_NAME / APP_DOMAIN, not the container name.
- DNS recommendations for the mail domains.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/tests/identity/test_registration_policy.py

@@ -137,7 +137,11 @@ async def test_register_is_refused_while_closed(
 
     status = await client.get("/api/auth/registration")
     assert status.status_code == 200
-    assert status.json() == {"open": False, "bootstrap": False}
+    assert status.json() == {
+        "open": False,
+        "bootstrap": False,
+        "domain": get_settings().app_domain,
+    }
 
     refused = await client.post(
         "/api/auth/register", json={"localpart": _localpart(), "password": PASSWORD}