Send sign-in mail as HTML so quoted-printable wrapping cannot break the verify URL.

Staging was delivering magic links that looked expired because the token query string was encoded and wrapped in plaintext MIME. Also read rate-limit retry from the API error body, mention spam in the success copy, and document SES relay DNS.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/guides/ops-backend-deploy.md

@@ -101,8 +101,16 @@ per-app in the manifest and provisioned at install time.
 - Backups: Cloudron's automatic backups are already on for the host
   (legacy app shows weekly snapshots ~451 MB each). Same default
   applies to new apps.
-- TLS / DNS / SPF / DKIM: handled by Cloudron for any subdomain of
-  `communityrule.info`.
+- TLS for Cloudron app hostnames: handled by Cloudron (Let's Encrypt).
+- **Mail DNS (SPF/DKIM):** *not* automatic for this domain. Cloudron's
+  DNS provider for `communityrule.info` is Namecheap, but outbound mail
+  is **Amazon SES relay**. Cloudron's own mail-status check **skips**
+  SPF and DKIM and says to configure them on the relay. Add the SES
+  identity's **DKIM CNAME** records (and optionally
+  `include:amazonses.com` on SPF) in Cloudron → *Domains* →
+  `communityrule.info` → DNS so they publish to Namecheap. See
+  [`ops-runbook.md`](ops-runbook.md) §8.1. DMARC on the domain is
+  currently `p=reject`.
 
 ## 5. Cutover plan (side-by-side, never in-place)
 
@@ -476,7 +484,7 @@ steps below are still required.
 | ------- | ------------ | ----- |
 | Image pull error on install | Repo still private, or wrong tag in manifest | §6.3; `docker pull --platform linux/amd64 …` from laptop |
 | Health `503` / `database: disconnected` | Postgres addon not provisioned or URL missing | Cloudron app → Environment; expect `CLOUDRON_POSTGRESQL_URL` |
-| Magic link not sent | Mail addon or `SMTP_FROM` | Cloudron mail logs; `CLOUDRON_MAIL_SMTP_*` vars |
+| Magic link not sent | Mail addon, `SMTP_FROM`, or SES DNS | Cloudron mail logs; `CLOUDRON_MAIL_SMTP_*`; [ops-runbook §8.1](ops-runbook.md#81-mail-dns-when-ses-is-the-relay) |
 | Upload `server_misconfigured` | `UPLOAD_ROOT` unset | Set to `/app/data/uploads` (§3) |
 | Container crash on start | Migration failure | App logs around `prisma migrate deploy` |
 | No "Recommended" on method cards | `MethodFacet` not seeded | §10 step 6; API should return `matches.score > 0` for some methods when `facet.*` set |