Resolved merge conflicts in config/deploy.yml and config/environments/production.rb
while preserving fork-specific functionality:

- Adopted upstream's SMTP_ADDRESS naming (was SMTP_HOST)
- Adopted upstream's conditional SMTP configuration pattern
- Preserved fork's custom secrets: APP_HOST, REPLY_TO_EMAIL, ALLOWED_EMAIL_ADDRESSES
- Preserved fork's default_url_options for multi-tenant URL generation
- Updated .kamal/secrets.production to use SMTP_ADDRESS
- Updated DEPLOYMENT.md documentation

Upstream changes include:
- Basic API functionality (basecamp#1766)
- CSP enforcement (basecamp#2070)
- Speedy storage tracking (basecamp#2026)
- MySQL SSL configuration
- Many bug fixes and improvements

* main: (117 commits)
  Explain that the upload URL is account-scope
  Allow direct uploads via API
  Storage: ignore jobs for now-deleted targets
  API: Support `created_at` for API card and comment creation (#2056)
  Enforce CSP (#2070)
  CSP: full config with env vars per source (#2069)
  Speedy, auditable, deadlock-resistant storage tracking (#2026)
  Gitleaks: ignore legit non-sensitive API keys and tokens in docs/ and test/ (#2068)
  Get gitleaks-audit green again
  Bump actions/checkout from 4 to 6 (#2047)
  Bump docker/login-action from 3.5.0 to 3.6.0 (#2046)
  Bump docker/metadata-action from 5.8.0 to 5.10.0 (#2045)
  Bump sigstore/cosign-installer from 3.9.2 to 4.0.0 (#2044)
  make MySQL SSL mode configurable via env var (#2036)
  Update tip text for turning a card into a Golden Ticket
  Revert "Fix Lexxy prompt list padding by lowering rich-text specificity"
  Fix Lexxy prompt list padding by lowering rich-text specificity
  Improve phrasing
  Fix crash due to missing partial
  Fix status and filter mistakes
  ...

…tylesheets+edits

* mobile-app/scoped-stylesheets: (117 commits)
  Explain that the upload URL is account-scope
  Allow direct uploads via API
  Storage: ignore jobs for now-deleted targets
  API: Support `created_at` for API card and comment creation (#2056)
  Enforce CSP (#2070)
  CSP: full config with env vars per source (#2069)
  Speedy, auditable, deadlock-resistant storage tracking (#2026)
  Gitleaks: ignore legit non-sensitive API keys and tokens in docs/ and test/ (#2068)
  Get gitleaks-audit green again
  Bump actions/checkout from 4 to 6 (#2047)
  Bump docker/login-action from 3.5.0 to 3.6.0 (#2046)
  Bump docker/metadata-action from 5.8.0 to 5.10.0 (#2045)
  Bump sigstore/cosign-installer from 3.9.2 to 4.0.0 (#2044)
  make MySQL SSL mode configurable via env var (#2036)
  Update tip text for turning a card into a Golden Ticket
  Revert "Fix Lexxy prompt list padding by lowering rich-text specificity"
  Fix Lexxy prompt list padding by lowering rich-text specificity
  Improve phrasing
  Fix crash due to missing partial
  Fix status and filter mistakes
  ...