One secured SMTP path, optional login, sender and reply address, failing health

The message endpoint used implicit TLS and the PDF endpoint STARTTLS on
the same port, so one of them always failed. Both now share one
connection path with an explicit SMTP_RELAY_SECURITY, log in only with
credentials, and take SMTP_FROM and SMTP_REPLY_TO. /health answers 503
when the SMTP server refuses, so the container turns unhealthy instead
of looking fine. The old tests never ran; eight new ones do, in CI too.

CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to libreshop/mail are documented here.
 
+## v0.2.0 - 2026-10-15
+
+- One SMTP connection path for `/v1/send/message`, `/v1/send/pdf` and `/health`. Before, the message endpoint always
+  used implicit TLS and the PDF endpoint always STARTTLS on the same port, so one of them failed whatever the port.
+- `SMTP_RELAY_SECURITY` (`ssl`, `starttls`, `none`; default by port). A failed STARTTLS is an error instead of a
+  plain-text login.
+- Login only when `SMTP_RELAY_USERNAME` and `SMTP_RELAY_PASSWORD` are both set, so a trusted relay works without
+  credentials.
+- `SMTP_FROM` sets the sender (default `SMTP_RELAY_USERNAME`), `SMTP_REPLY_TO` the reply address. Every mail carries
+  `Date` and `Message-ID`.
+- `/health` answers 503 when the SMTP server does not accept the connection, so Docker marks the container unhealthy.
+- Unit tests that run (8), and a CI test job.
+
 ## Unreleased
 
 - Extracted from `mp/mail/` (2026-04-29). The component history before