Use Mailpit in the Docker stacks so the demo can show email verification and password reset

[devondragon]

Problem

The Docker demo stacks (compose.yaml and docker-compose-keycloak.yml) run docker-mailserver with SMTP_ONLY=1. It is a relay with no route to real inboxes, so mail the app sends is accepted and dropped. To make the "5 minute" Docker path usable, #85 sets USER_REGISTRATION_SENDVERIFICATIONEMAIL=false in both stacks. That means the Docker demo never shows the framework's email flows: registration verification, password reset, and the resend-verification page. It also means the two-hop registration flow (register, click link in email, log in) that most adopters will actually ship is not something the demo can exercise without a real SMTP account.

Proposal

Replace docker-mailserver with a capturing SMTP server that has a web inbox, and turn verification back on in the Docker stacks:

• Service: axllent/mailpit (SMTP on 1025, web UI on 8025; single small image, no config files, no NET_ADMIN/SYS_PTRACE capabilities, no mailserver.env). MailHog is the older alternative but is unmaintained.
• App env: SPRING_MAIL_HOST=mailpit, SPRING_MAIL_PORT=1025, auth/starttls off (as today), and drop USER_REGISTRATION_SENDVERIFICATIONEMAIL=false so registration sends the verification mail.
• Publish 8025:8025 and document "open http://localhost:8025 to read the verification and password-reset emails" in the README quick start, docs/CONFIGURATION.md (mail section), docs/AUTHENTICATION.md (username/password section), and keycloak/README.md.
• Remove mailserver.env and the ./config/ mail volume mount and the maildata/mailstate/maillogs volumes; update .dockerignore if it lists them.
• Healthcheck: Mailpit serves GET /livez on 8025 (verify against the current image docs).

Acceptance

• docker compose up --build from a fresh clone: register at /user/register.html, open http://localhost:8025, click the verification link, log in.
• Password reset from /user/forgot-password.html produces a mail visible in Mailpit and the link works.
• Same in the Keycloak stack.
• Playwright: not affected (the playwright-test profile disables outbound mail and runs outside Docker), but confirm CI still passes.

Notes

• Keep spring.mail.* in base application.yml pointing at a real SMTP placeholder for non-Docker runs; only the compose stacks switch to Mailpit.
• Decided against doing this in docs: rewrite README into docs/, fix documented run paths, Keycloak stack, and two demo bugs #85 to keep that PR to fixing what the docs already described.