Invite a friend; handle field shows the domain; system mail fixes

- Invitations: each user can invite two friends by email (sign-up works
  through the link even while registration is closed); admin-editable
  template, subject and sender.
- Invitation sender defaults to the system-mail From address, which the
  SMTP account is allowed to send as (was postmaster@APP_DOMAIN, refused
  with 553 when the two differ).
- Sign-in, sign-up and forgot-password fields show the fixed
  @domain after the typed name; the registration status reports it.
- System mail gets a Date header; the invitation's plain-text part keeps
  its paragraphs and line breaks.
- SMTP EHLO uses SMTP_HELO_NAME / APP_DOMAIN, not the container name.
- DNS recommendations for the mail domains.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/tests/outbox/test_inline_images.py

@@ -131,3 +131,41 @@ def test_links_already_sent_load_from_here() -> None:
         result = sanitize_html(f'<img src="{src}">', uuid.uuid4(), allow_remote_images=True)
         assert f'src="/api/messages/{mid}/cid/logo@x"' in result.html, src
         assert not result.has_remote_images
+
+
+async def test_images_written_into_the_html_go_as_inline_parts() -> None:
+    """A signature logo pasted into the editor is a data: URL, which Gmail does
+    not show in mail it receives: it is sent as an inline part instead, once
+    however often it appears."""
+    import base64
+
+    data_url = "data:image/png;base64," + base64.b64encode(LOGO).decode()
+    html = (
+        f'<p>Hi</p><img src="{data_url}" width="40"><p>--</p><img src="{data_url}">'
+        '<img src="data:text/html;base64,PHNjcmlwdD4=">'  # not an image: left alone
+    )
+    out, parts = await inline_images.embed(None, uuid.uuid4(), html, "example.com")  # type: ignore[arg-type]
+    assert len(parts) == 1
+    assert parts[0].data == LOGO and parts[0].mime_type == "image/png"
+    assert parts[0].filename == "image.png"
+    assert out.count(f'src="cid:{parts[0].cid}"') == 2
+    assert "data:image/png" not in out
+    assert 'width="40"' in out
+
+    account = SimpleNamespace(email="me@example.com", display_name="Me")
+    draft = SimpleNamespace(payload={"to": ["a@example.org"], "subject": "Sig", "html": html})
+    raw, _, _, _ = build_mime(account, draft, None, [], html=out, inline=parts)  # type: ignore[arg-type]
+    msg = email.message_from_bytes(raw, policy=policy.default)
+    images = [p for p in msg.walk() if p.get_content_type() == "image/png"]
+    assert len(images) == 1 and images[0].get_content() == LOGO
+    assert images[0]["Content-ID"] == f"<{parts[0].cid}>"
+
+
+def test_smtp_servers_are_greeted_with_our_domain(monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    from app.config import smtp_helo_name
+
+    settings = get_settings()
+    monkeypatch.setattr(settings, "smtp_helo_name", "")
+    assert smtp_helo_name() == settings.app_domain
+    monkeypatch.setattr(settings, "smtp_helo_name", "mail.example.org")
+    assert smtp_helo_name() == "mail.example.org"