feat(wordpress): smoke-test the mail relay the role already wires up

The role has shipped complete mail plumbing all along: the Dockerfile installs
msmtp and msmtp-mta (so PHP mail() relays through it), vars/main.yml:23 renders
sys-svc-mail-msmtp's msmtprc template, meta/volumes.yml mounts it at
/etc/msmtprc, and tasks/main.yml:26 transfers it on every deploy, ungated.

What was missing is the services.email declaration. container_healthcheck only
emits the msmtp half of the msmtp_curl probe when services.email.enabled is
true, so the flavor the role declares has been rendering as a bare curl and the
relay path was never exercised. WordPress mail could have been broken for
months without a single red job.

Declaring email restores the smoke test, and the assertion added after
convergence reports the relay's refusal in the clear instead of leaving it in a
health log nobody reads.

The flag is reactive ('web-app-mailu' in group_names), so it does not pull the
provider in: the derived swarm closure is 24 members with mailu both before and
after.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-wordpress/meta/services.yml

@@ -17,6 +17,10 @@ matomo:
   bond: 1
   enabled: "{{ 'web-app-matomo' in group_names }}"
   shared: "{{ 'web-app-matomo' in group_names }}"
+email:
+  bond: 1
+  enabled: "{{ 'web-app-mailu' in group_names }}"
+  shared: "{{ 'web-app-mailu' in group_names }}"
 # nocheck: playwright-service-flag, DB engine, covered by role-local integration tests
 mariadb:
   bond: 1

roles/web-app-wordpress/tasks/07_manager_ops.yml

@@ -56,3 +56,26 @@
   when: (wp_is_multisite.stdout | trim) == '0'
   vars:
     wp_new_url: "{{ WORDPRESS_URL }}"
+
+- name: "📧 Verify the relay accepted WordPress's startup mail"
+  when: lookup('config', application_id, 'services.email.enabled', false) | bool
+  block:
+    - name: "⏳ Wait for the delivery marker the healthcheck writes"
+      shell: >
+        container exec {{ WORDPRESS_CONTAINER_ADDRESS }} test -f {{ lookup('container_mail_marker') }}
+      register: wordpress_smoke_mail
+      changed_when: false
+      failed_when: false
+      retries: 30
+      delay: 5
+      until: wordpress_smoke_mail.rc == 0
+
+    - name: "🛑 Report a relay that refused every attempt"
+      ansible.builtin.assert:
+        that: wordpress_smoke_mail.rc == 0
+        fail_msg: >-
+          WordPress never delivered its startup mail. The healthcheck writes
+          {{ lookup('container_mail_marker') }} only after msmtp exits 0, so
+          the relay refused every attempt. Its reason is in the container's
+          State.Health.Log; liveness itself is unaffected, which is why the
+          stack still converged.