auto mail generation

.env

@@ -66,3 +66,24 @@ REDIS_DB=0
 POS_TOKEN_SECRET=local-dev-signing-secret-not-real
 JWT_SECRET_KEY=
 USER_CONTEXT_KEY=
+
+# ── Email ───────────────────────────────────────────────────────────────────
+#
+# The first-password invitation. See docs/MAIL_SETUP.md.
+#
+# MAIL_HOST IS DELIBERATELY BLANK HERE. This file is tracked and shared, and a
+# host set here would mean any local run could email a real merchant a real
+# password link. Blank is the documented off state: the server boots, onboarding
+# works, and every create answers `invited: false` with the reason.
+#
+# Turn it on by putting the Postal host and its per-application credentials in
+# `.env.secrets`, which is read first and is the only one of these git ignores.
+MAIL_HOST=
+MAIL_PORT=587
+MAIL_USERNAME=
+MAIL_PASSWORD=
+# On nearledaily.com because the link points at app.nearledaily.com — a password
+# mail whose sender and destination are different domains reads as phishing.
+MAIL_FROM=care@nearledaily.com
+MAIL_FROM_NAME=Nearle
+MAIL_CONSOLE_URL=https://app.nearledaily.com