The message endpoint used implicit TLS and the PDF endpoint STARTTLS on the same port, so one of them always failed. Both now share one connection path with an explicit SMTP_RELAY_SECURITY, log in only with credentials, and take SMTP_FROM and SMTP_REPLY_TO. /health answers 503 when the SMTP server refuses, so the container turns unhealthy instead of looking fine. The old tests never ran; eight new ones do, in CI too.