feat(services): config schemas for the rest of the registry + textarea base64 transport

- Declarative config_schema on RDP, Telnet, MySQL, Redis, SMTP, SMTP_Relay
  matching the keys each service already reads at compose time.
- TODO marker on the 19 services that accept service_cfg but never read it,
  so future contributors know where to plug schemas in.
- Wizard base64-wraps all textarea values at INI emit (DeckyFleet
  buildIni); validate_cfg detects the b64: sentinel and decodes back to
  UTF-8. Plain raw strings still pass through for direct API submitters.
- HTTPS image entrypoint accepts PEM content or path in TLS_CERT/TLS_KEY:
  detects a BEGIN header, writes content to /opt/tls/, and re-exports
  the on-disk path so server.py keeps reading paths.
- Tests cover schema/compose alignment for each new service plus
  textarea base64 round-trip (incl. UTF-8) and HTTPS PEM end-to-end.

decnet/services/smtp.py

@@ -1,7 +1,7 @@
 import os
 from pathlib import Path
 
-from decnet.services.base import BaseService
+from decnet.services.base import BaseService, ServiceConfigField
 
 TEMPLATES_DIR = Path(__file__).parent.parent / "templates" / "smtp"
 ARTIFACTS_ROOT = os.environ.get("DECNET_ARTIFACTS_ROOT", "/var/lib/decnet/artifacts")
@@ -16,6 +16,24 @@ class SMTPService(BaseService):
     ports = [25, 587]
     default_image = "build"
 
+    config_schema = [
+        ServiceConfigField(
+            key="banner",
+            label="SMTP greeting banner",
+            type="string",
+            placeholder="mail.corp.local ESMTP Postfix",
+            help="First line returned on TCP connect (220 ...).",
+        ),
+        ServiceConfigField(
+            key="mta",
+            label="MTA persona",
+            type="enum",
+            enum=["postfix", "exim", "sendmail"],
+            default="postfix",
+            help="Shapes EHLO capability list and error wording.",
+        ),
+    ]
+
     def compose_fragment(
         self,
         decky_name: str,