[rschlaefli]

What This Adds

This PR updates the Escapp fork for the DF Cloud rollout:

1. Replaces SendGrid password-reset delivery with Nodemailer SMTP, defaulting to Resend-compatible SMTP settings while keeping provider config env-driven.
2. Makes the existing filesystem upload fallback usable when CLOUDINARY_URL is not set.
3. Preserves uploaded file extensions, creates the upload directory at runtime/image build time, and routes attachment rendering through the attachment helper so local uploads render from /uploads.

How It Works

• SMTP uses SMTP_HOST, SMTP_PORT, SMTP_SECURE, SMTP_USERNAME, SMTP_PASSWORD, and optional SMTP_FROM.
• Local uploads use UPLOADS_PATH, defaulting to public/uploads.
• Cloudinary remains supported when CLOUDINARY_URL is present, but it is no longer required for upload paths.
• Companion deployment changes are in df-cloud and helm-charts branches named codex/escapp-local-uploads-keda.

Branch Coverage

• Base: master
• Head: 478d1dd
• Reviewed: 2 commits, 12 files changed, 97 insertions and 135 deletions.
• Covered: SMTP mailer switch, SendGrid dependency removal, env template updates, local upload fallback, upload rendering path updates, Docker upload directory setup.

Verification

Current head:

• npx eslint helpers/mailer.js helpers/attachments.js controllers/assets_controller.js controllers/hint_controller.js controllers/escapeRoom_controller.js helpers/utils.js -> passed
• node -e "require(\"./helpers/mailer\"); require(\"./helpers/attachments\"); console.log(\"modules load\")" -> passed
• git diff --check -> passed

Not run:

• Full app test suite and browser upload flow -> requires app runtime/database setup.
• Live SMTP send -> requires real SMTP credentials.

Security / Privacy

• No secrets committed.
• SMTP_PASSWORD remains runtime-only.
• Local uploads require persistent storage in Kubernetes; deployment manifests add a PVC separately.

Blocking Before Merge

None for source review.

Follow-Up After Merge

• Merge/update helm-charts and df-cloud companion branches.
• Confirm SMTP_PASSWORD and SMTP_FROM are present in Escapp Infisical before deploying.
• Verify upload, restart persistence, and password-reset email in STG.