Invite a friend; handle field shows the domain; system mail fixes

- Invitations: each user can invite two friends by email (sign-up works
  through the link even while registration is closed); admin-editable
  template, subject and sender.
- Invitation sender defaults to the system-mail From address, which the
  SMTP account is allowed to send as (was postmaster@APP_DOMAIN, refused
  with 553 when the two differ).
- Sign-in, sign-up and forgot-password fields show the fixed
  @domain after the typed name; the registration status reports it.
- System mail gets a Date header; the invitation's plain-text part keeps
  its paragraphs and line breaks.
- SMTP EHLO uses SMTP_HELO_NAME / APP_DOMAIN, not the container name.
- DNS recommendations for the mail domains.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/vite.config.ts

@@ -23,10 +23,12 @@ export default defineConfig({
     proxy: {
       "/api": {
         target: "http://127.0.0.1:8000",
-        changeOrigin: true,
+        // Host kept as the browser sent it: the API's cross-site check
+        // (app/security/cross_site.py) compares the page's Origin with it, and
+        // a WebSocket upgrade carries only Origin (no Sec-Fetch-Site, and the
+        // proxy adds no X-Forwarded-Host to upgrades).
+        changeOrigin: false,
         ws: true,
-        // X-Forwarded-Host: the API's cross-site check (app/security/cross_site.py)
-        // compares the page's Origin with the name the browser used.
         xfwd: true,
       },
       // CalDAV / CardDAV (SPEC Appendix E), for trying clients against dev.