feat: combine mail-plane charts into one umbrella Helm chart at helm/

[Aravinda-HWK]

What

Combines the four mail-plane charts into a single umbrella Helm chart at helm/, so the whole outbound-mail stack installs as one release instead of four:

helm upgrade --install pingmailer ./helm -n <namespace> -f my-values.yaml

helm/
├── Chart.yaml            # umbrella, declares the 4 subcharts
├── values.yaml           # defaults + the values you must fill in
├── values.example.yaml   # a complete install to copy from
├── README.md             # deployment guide
├── templates/NOTES.txt
└── charts/{api-server, opendkim-server, raven-sasl-server, smtp-server}/

Each service stays a self-contained subchart and can still be installed on its own. Every subchart is gated by <name>.enabled, so the stack can be rolled out piecemeal.

Why the subcharts were renamed

Subchart name: fields now match their directories (silver-api-server → api-server, etc.) so umbrella values keys read naturally (smtp-server.domain rather than silver-smtp.domain).

This is safe: every subchart pins fullnameOverride, so no Service DNS name changes. Postfix's inet:opendkim-server:8891 and inet:raven-sasl:12345 wiring is untouched.

Also in this PR

hostAliases added to the api-server subchart. Callers pass smtp_host in the /notify body and the api-server verifies the SMTP TLS certificate against that name. The Service name smtp-server is not on the mail certificate, and the public mail hostname isn't reachable from inside the cluster (no hairpin). Mapping the cert-matching name to the SMTP ClusterIP fixes both. This previously existed only as a live oc patch and was silently lost on every redeploy — every send failed while /notify still returned 202.

helm/README.md — prerequisites, required values, DNS records, installing a subset, exposing SMTP, upgrade/rollback, troubleshooting, plus:

• an OpenShift section: Route vs Ingress, restricted-v2 UID assignment, ResourceQuota requirements, NodePort for SMTP
• an end-to-end in-cluster mail test procedure

Environment-specific references generalised across chart comments — no cluster, namespace, domain, or address from any particular deployment remains.

certbot-server intentionally stays under mail-infra/helm/ — certificate issuance has its own lifecycle and is a prerequisite, not a component of this chart.

Notable gotchas documented

• raven-sasl-server pins UID 1001, which restricted-v2 rejects at ReplicaSet level, so you get no pod and no pod events. Note that podSecurityContext: {} does not clear it — Helm merges empty maps into the subchart's populated map, so each key must be nulled individually.
• The api-server 0.1.0 tag exits demanding CERT_FILE/KEY_FILE; 0.1.1 is arm64-only. image.tag: "" resolves to appVersion (0.1.0), which is not what you want.
• POST /notify returns 202 Email queued successfully even when the SMTP send later fails — never treat it as proof of delivery.
• hostAliases pins a ClusterIP, so it needs refreshing if the smtp-server Service is recreated.

Verification

• helm lint passes on the umbrella and on all four subcharts standalone
• umbrella renders 19 resources with the example values
• --set <name>.enabled=false correctly drops a subchart
• required-value guards survived the move (bare render fails with a readable domain is required)
• full uninstall → reinstall cycle on OpenShift: all four components came up on the first install, and mail was delivered end-to-end (XOAUTH2 auth via raven → Postfix submission → relayed out, status=sent, 250 2.0.0 OK)

Note for reviewers

Deployment-specific values are not committed. .gitignore gained my-values.yaml / my-*-values.yaml for local values files, which carry the OAuth client ID and sender allowlist.

[maneesha-xyz]

LGTM.