One secured SMTP path, optional login, sender and reply address, failing health (#3)

Co-authored-by: Michael Czechowski <mail@librete.ch>

CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to libreshop/mail are documented here.
 
+## v0.2.0 - 2026-10-15
+
+- One SMTP connection path for `/v1/send/message`, `/v1/send/pdf` and `/health`. Before, the message endpoint always
+  used implicit TLS and the PDF endpoint always STARTTLS on the same port, so one of them failed whatever the port.
+- `SMTP_RELAY_SECURITY` (`ssl`, `starttls`, `none`; default by port). A failed STARTTLS is an error instead of a
+  plain-text login.
+- Login only when `SMTP_RELAY_USERNAME` and `SMTP_RELAY_PASSWORD` are both set, so a trusted relay works without
+  credentials.
+- `SMTP_FROM` sets the sender (default `SMTP_RELAY_USERNAME`), `SMTP_REPLY_TO` the reply address. Every mail carries
+  `Date` and `Message-ID`.
+- `/health` answers 503 when the SMTP server does not accept the connection, so Docker marks the container unhealthy.
+- Unit tests that run (8), and a CI test job.
+
 ## Unreleased
 
 - Extracted from `mp/mail/` (2026-04-29). The component history before