feat(api/contact): wire env-driven SMTP for contact + project inquiry forms

Both the contact form (/contact) and the homepage "Tell us about your project"
inline lead form post to /api/contact. Updated that single handler to build
the nodemailer transport from a clean set of SMTP_* env vars per spec:

  SMTP_HOST / SMTP_PORT / SMTP_USER / SMTP_PASS
  SMTP_FROM + SMTP_FROM_NAME  -> "From: Ajay Ghanwat <ghanwat.ajay@workroot.in>"
  MAIL_ADMIN_TO               -> admin notification recipient
                                  (falls back to SMTP_FROM, then legacy
                                   CONTACT_EMAIL_TO / CONTACT_EMAIL / SMTP_USER)
  SMTP_REQUIRE_TLS            -> force STARTTLS upgrade on port 587
  SMTP_CONNECTION_TIMEOUT_MS  -> defaults to 10000
  SMTP_GREETING_TIMEOUT_MS    -> defaults to 10000
  SMTP_SOCKET_TIMEOUT_MS      -> defaults to 10000

Behaviour preserved:
- Existing user-facing auto-reply (the block previously at L270) kept.
  Subject + body now adapt for project-inquiry sources (homepage-inline,
  homepage-hero, homepage-final-cta, mobile-sticky) so the admin inbox
  can triage [Project Inquiry] vs [Contact Form] at a glance.
- Graceful degradation per FORM_INTEGRATION.md: missing env vars or a
  failed nodemailer import logs a structured warning and returns 200 —
  the site never 500s on email config.
- Rate limiting, honeypot, CORS, validation, and fire-and-forget
  background dispatch are untouched.

Observability:
- Structured console logs at: transport created, admin accepted (with
  messageId), user auto-reply accepted (with messageId), and send-failure
  (with smtp code/command/response). SMTP_PASS is never logged.

Misc:
- .env.example updated to document the new variables and the legacy
  aliases that are still honored.

.env.example

@@ -37,12 +37,32 @@ NODE_ENV=production
 # ==================================
 # Contact Form & Email (SMTP)
 # ==================================
-# Used by /api/contact for sending contact form submissions
-# If not set, submissions are logged to console (dev/staging mode)
-# SMTP_HOST=smtp.gmail.com
-# SMTP_PORT=587
-# SMTP_USER=your_email@example.com
-# SMTP_PASS=your_app_password_here
+# Used by /api/contact (powers both the contact page form AND the
+# homepage "Tell us about your project" inline lead form).
+# If unset, submissions are logged to console (dev/staging mode).
+#
+# --- Required for live email delivery ---
+# SMTP_HOST=smtp.hostinger.com
+# SMTP_PORT=587                        # 587 = STARTTLS (recommended)
+# SMTP_USER=ghanwat.ajay@workroot.in
+# SMTP_PASS=your_app_password_here     # MARK AS SECRET in platform UI
+#
+# --- From header (RFC 5322) ---
+# SMTP_FROM=ghanwat.ajay@workroot.in
+# SMTP_FROM_NAME=Ajay Ghanwat
+#
+# --- Admin recipient for inbound submissions ---
+# Falls back to SMTP_FROM, then legacy CONTACT_EMAIL_TO/CONTACT_EMAIL.
+# MAIL_ADMIN_TO=ghanwat.ajay@workroot.in
+#
+# --- TLS & timeouts (optional, sensible defaults applied) ---
+# SMTP_REQUIRE_TLS=true                # set to "false" to disable STARTTLS upgrade
+# SMTP_CONNECTION_TIMEOUT_MS=10000
+# SMTP_GREETING_TIMEOUT_MS=10000
+# SMTP_SOCKET_TIMEOUT_MS=10000
+#
+# --- Legacy aliases (still honored for backwards compatibility) ---
+# CONTACT_EMAIL_TO=hello@workroot.in
 # CONTACT_EMAIL=hello@workroot.in
 
 # ==================================