Invite a friend; handle field shows the domain; system mail fixes

- Invitations: each user can invite two friends by email (sign-up works
  through the link even while registration is closed); admin-editable
  template, subject and sender.
- Invitation sender defaults to the system-mail From address, which the
  SMTP account is allowed to send as (was postmaster@APP_DOMAIN, refused
  with 553 when the two differ).
- Sign-in, sign-up and forgot-password fields show the fixed
  @domain after the typed name; the registration status reports it.
- System mail gets a Date header; the invitation's plain-text part keeps
  its paragraphs and line breaks.
- SMTP EHLO uses SMTP_HELO_NAME / APP_DOMAIN, not the container name.
- DNS recommendations for the mail domains.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -79,6 +79,8 @@ x-backend-env: &backend-env
   SENDER_AVATARS_ENABLED: ${SENDER_AVATARS_ENABLED:-true}
   # New passwords checked against Have I Been Pwned (k-anonymity; docs §5.2).
   PASSWORD_BREACH_CHECK: ${PASSWORD_BREACH_CHECK:-true}
+  # Name given to SMTP servers when sending (EHLO). Empty: APP_DOMAIN.
+  SMTP_HELO_NAME: ${SMTP_HELO_NAME:-}
   GOOGLE_OAUTH_ENABLED: ${GOOGLE_OAUTH_ENABLED:-false}
   OAUTH_GOOGLE_CLIENT_ID: ${OAUTH_GOOGLE_CLIENT_ID:-}
   OAUTH_GOOGLE_CLIENT_SECRET: ${OAUTH_GOOGLE_CLIENT_SECRET:-}