One secured SMTP path, optional login, sender and reply address, failing health

The message endpoint used implicit TLS and the PDF endpoint STARTTLS on
the same port, so one of them always failed. Both now share one
connection path with an explicit SMTP_RELAY_SECURITY, log in only with
credentials, and take SMTP_FROM and SMTP_REPLY_TO. /health answers 503
when the SMTP server refuses, so the container turns unhealthy instead
of looking fine. The old tests never ran; eight new ones do, in CI too.

.gitea/workflows/build.yml

@@ -8,7 +8,20 @@ on:
     branches: [main]
 
 jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: unit tests in the image's Python
+        run: |
+          tar -c --exclude=.git . | docker run -i --rm python:3.13.1-alpine3.20 sh -c \
+            'mkdir /w && tar -x -C /w && cd /w && pip install -q -r requirements.txt && PYTHONPATH=src python -m unittest discover -s src/tests'
+
   build:
+    needs: test
     runs-on: ubuntu-latest
     container:
       image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e