Portal v0.6.21 serves this repo's .well-known/ at the root of the site,
so security.txt is a file in this repo rather than something only a
reverse proxy could place. A path that is not here answers 404 now,
instead of the app shell answering 200 with HTML.
Caddy also hands /.well-known/caldav and /.well-known/carddav to
Stalwart, which answers each with a 307 to the collection. RFC 6764 has
a client look for these on the domain its address is in - and iOS uses
them, which matters because Apple Mail ignores both autoconfig and
Autodiscover for IMAP accounts and discovers nothing else by itself.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015GeH3y8fwTaTudaD88P57o
