Serve the DAV collections the discovery redirects point at

/.well-known/caldav answered 307 to https://<domain>/dav/cal, and that
path was portal's catch-all - so a client that did the discovery
correctly followed it into an HTML page. Stalwart builds the Location
from the forwarded host rather than the Host this route rewrites, so
rather than fight that, /dav/* is served here too and the client stays
on one origin for the whole exchange.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015GeH3y8fwTaTudaD88P57o

.gitea/workflows/deploy.yml

@@ -133,7 +133,13 @@ jobs:
           	# these on the domain its address is in, and Stalwart answers
           	# each with a 307 to the collection. iOS uses these even though
           	# Apple Mail ignores autoconfig and Autodiscover entirely.
-          	@dav path /.well-known/caldav /.well-known/carddav
+          	# The collections the two redirects above point at. Stalwart builds
+          	# those Location headers from the forwarded host, not from the Host
+          	# this route rewrites, so they land on the bare domain - which means
+          	# the collections have to be reachable here too, or a client follows
+          	# a 307 into portal's catch-all. Keeping them on one host is the
+          	# better answer anyway: the client never changes origin.
+          	@dav path /.well-known/caldav /.well-known/carddav /dav/*
           	handle @dav {
           		reverse_proxy stalwart:8080 {
           			header_up Host mail.{$DOMAIN}