Publish files at the site root, and find CalDAV from the bare domain

Portal v0.6.21 serves this repo's .well-known/ at the root of the site,
so security.txt is a file in this repo rather than something only a
reverse proxy could place. A path that is not here answers 404 now,
instead of the app shell answering 200 with HTML.

Caddy also hands /.well-known/caldav and /.well-known/carddav to
Stalwart, which answers each with a 307 to the collection. RFC 6764 has
a client look for these on the domain its address is in - and iOS uses
them, which matters because Apple Mail ignores both autoconfig and
Autodiscover for IMAP accounts and discovers nothing else by itself.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015GeH3y8fwTaTudaD88P57o

.gitea/workflows/deploy.yml

@@ -18,7 +18,7 @@ on:
       - .gitea/workflows/deploy.yml
 
 env:
-  PORTAL_RELEASE: v0.6.15
+  PORTAL_RELEASE: v0.6.21
   INSTANCE: uhhm-portal
 
 jobs:
@@ -129,6 +129,17 @@ jobs:
           		}
           	}
 
+          	# CalDAV and CardDAV discovery (RFC 6764): a client looks for
+          	# these on the domain its address is in, and Stalwart answers
+          	# each with a 307 to the collection. iOS uses these even though
+          	# Apple Mail ignores autoconfig and Autodiscover entirely.
+          	@dav path /.well-known/caldav /.well-known/carddav
+          	handle @dav {
+          		reverse_proxy stalwart:8080 {
+          			header_up Host mail.{$DOMAIN}
+          		}
+          	}
+
           	@autodiscover path /Autodiscover/* /autodiscover/* /AutoDiscover/*
           	handle @autodiscover {
           		reverse_proxy stalwart:8080 {