rioho mail services managed deployment

Upstream base: plMail v0.3.5, ff87ee92d77578cdb70f7f409c039c277568beb9
Base image is pinned by digest in Dockerfile.rioho. The corresponding source
retains upstream copyright notices and AGPL-3.0-or-later licensing.

This variant deliberately permits only OpenID Connect sign-in and requires
the operator's private provisioner to pin mailbox ownership to issuer/subject.
It does not link by a browser-supplied email claim. The public source archive
does not include credentials, user data or deployment environment files.

To build:
1. Create a tar.gz of this source tree excluding .git, vendor, node_modules,
   var, and the archive itself; place it at rioho-source.tar.gz.
2. docker build -f Dockerfile.rioho -t rioho-mail:managed-20261015-1 .
3. Use the existing upstream compose deployment with the rioho managed
   overlay. Install the host provisioner separately with root-only files.
   Configure the OIDC issuer/client secret privately. Never commit secrets.

The database and application encryption keys must be backed up together.
Do not replace the managed image with an upstream floating tag: that would
restore local sign-in, self-service account connection and the setup wizard.
