infrastructure: co-op now self-hosts on Infomaniak; document mail, DNS and backups

- New 'Where it runs' section: services moved to the co-op's own Infomaniak
  server (Swiss sovereign cloud, Geneva, renewable-powered, ISO 14001/50001/27001)
  from a personal Hostinger account on 2026-11-02; note the steward bot runs on a
  separate machine and was not part of the migration.
- DNS subsection: managed manually at domains.coop (nameservers yoursrs.com); the
  zone is only 11 records, with the apex A/AAAA and a wildcard A/AAAA carrying
  every application hostname.
- Backups subsection: encrypted nightly backups to Infomaniak Encrypted S3, kept
  seven days; the steward-bot host backs up selected home directories to the same
  object storage.
- New 'Mail' section: inbound mail is received directly by the box; the newsletter
  (Listmonk) sends via the Scaleway Transactional Email relay (SPF, DKIM and DMARC
  pass at p=reject), while the member portal still sends through the Cloudron mail
  service on the box. Both send as info@inference.coop.
- Correct the webmail URL: mail.inference.coop -> email.inference.coop (the
  Cloudron mail app vhost; mail.inference.coop is not a configured vhost).

infrastructure.md

@@ -26,6 +26,36 @@ Members ──> your own tools ────┘    gateway   │
 The whole stack runs on [Cloudron](https://cloudron.io), which handles hosting,
 single sign-on, and per-app isolation.
 
+## Where it runs
+
+The co-op's services run on a server the co-op owns and pays for directly, at
+**Infomaniak** — a Swiss sovereign cloud provider whose data centres are in
+Geneva, run on renewable energy, and certified to ISO 14001, ISO 50001 and
+ISO 27001. The stack moved there from a personal Hostinger account on
+**2026-11-02**; nothing about how members use the co-op changed in the move.
+
+One thing runs elsewhere: the co-op's **steward bot** — the automation behind the
+digests and the newsletter drafts — runs on a separate machine, not on the
+Cloudron server, and was not part of the migration.
+
+### DNS
+
+`inference.coop` is managed by hand at **domains.coop** (nameservers
+`ns1/ns2.yoursrs.com`). The zone is deliberately small — **eleven records**. Most
+of the co-op hangs off just a few of them: the apex (`inference.coop`), `www`,
+and a wildcard (`*.inference.coop`) point at the server, so each application
+hostname — chat, portal, dashboard, gateway, git, newsletter, vault and the rest
+— is served by the wildcard rather than having a record of its own. The DNS
+change sheet listing all eleven records is public, in
+[`co-op/runbooks`](https://git.inference.coop/co-op/runbooks).
+
+### Backups
+
+Cloudron writes **encrypted** backups to **Infomaniak's object storage** (the
+"Infomaniak Encrypted S3" site, in Switzerland) every night, and keeps the last
+**seven days**. The steward-bot host backs up its own selected home directories
+to the same object storage.
+
 ## Components
 
 | Component | Purpose | URL | Code |
@@ -43,11 +73,41 @@ single sign-on, and per-app isolation.
 | **Surfer** | Static hosting (landing page, thanks page) | inference.coop | [co-op/website](https://git.inference.coop/co-op/website) |
 | **Listmonk** | Member newsletter (auto-synced from membership) | newsletter.inference.coop | — |
 | **Vaultwarden** | Password manager (admin credentials) | vault.inference.coop | — |
-| **SnappyMail** | Webmail | mail.inference.coop | — |
+| **SnappyMail** | Webmail | email.inference.coop | — |
 
 Open Collective (billing and fiscal sponsorship) is the one external service in
 the flow — see [opencollective.com/inference-cooperative](https://opencollective.com/inference-cooperative).
 
+## Mail
+
+The `inference.coop` mail domain is the co-op's, and the mail itself runs on the
+co-op's Cloudron server.
+
+**Incoming** mail is received directly by that server — the domain's MX record
+points at it, it accepts mail on the standard SMTP port, and webmail and mail
+apps reach it over the usual encrypted ports (IMAP and SMTP over TLS). If mail
+to your `@inference.coop` address stops arriving, that is a fault on our side to
+fix, not a limitation of how the co-op is set up.
+
+**Outgoing** mail travels by two different paths, on purpose:
+
+- The **newsletter** (Listmonk) sends through **Scaleway Transactional Email**,
+  an EU-based SMTP relay, rather than from our own server. Our domain is
+  authenticated to that relay with its own DKIM key, and a real message has been
+  checked end to end: SPF, DKIM and DMARC all pass under a `p=reject` policy —
+  so anything claiming to be from us that the relay hasn't authenticated is
+  rejected outright rather than quietly filed away.
+- The **member portal's** transactional email — welcome messages, budget
+  notices, the confirmation the nightly membership sweep sends — still sends from
+  the co-op's own server, through the mail service Cloudron runs for us.
+
+Both paths send as **Inference Cooperative `<info@inference.coop>`**.
+
+Why split them: sending the newsletter through a relay lets a provider with
+established sending IPs carry a list this size, instead of leaning on one
+freshly-migrated server's reputation. Receiving we keep in-house, on our own
+hardware.
+
 ## Matrix
 
 Members get a federated Matrix account on our self-hosted Synapse