SMTP_FROM fail-closed (fallback removal)

SMTP_FROM hard-coded fallback at 4 call sites (email-transport.ts:117, email-admin.ts:8, email-outbox.ts:204/248) is the banned looks-like-it-worked shape per §Site Origin — an unverified Gmail send-as gets silently re-stamped (PLUTO-131 precedent: mis-attributed + spam-foldered). Make SMTP_FROM required, fail-closed via existing SmtpConfigError reject path. Prod has SMTP_FROM set so branch is dormant, low urgency. Secondary/bundle when smtp-config.ts next opens: drop SMTP_SECURE, derive secure from port (enamel's shipped shape).