Extract stalwart-provisioner + personal-stack adopt

[jorisjonkers-dev-agents]

Objective: schema-driven mail account/DKIM provisioning (GHCR image + validation CLI), v2 schema with passwordRef union (env/file/Vault-VSO).

Work:

• Move infra/stalwart Dockerfile/apply.sh/bootstrap.sh/accounts/plan templates/schema/validate-plan
• personal-stack uses schema + pinned image/CLI; keep domain accounts + DNS local

Part of #605.