release: 1.0.0, a changelog, one .env.example and the docs to match

- CHANGELOG.md and CHANGELOG.pt-BR.md, from the project history.
- .env.example now serves development and production; scripts/init-env.sh
  (make env) creates .env with random secrets. .env.production.example is gone.
- docs/RELEASING.md: the pipeline, how a version is cut and deployed, the runners.
- DEPLOYMENT.md and both READMEs updated for Gitea and the new env flow.
- Service versions set to 1.0.0.
- CI: the proxy network step is idempotent and the stack is torn down always,
  since the runner's Docker daemon now outlives a job.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -2,7 +2,7 @@
 <h1 align="center">LambdaMail</h1>
 <p align="center">Your own mail server, with a webmail that is a pleasure to use.<br>SMTP, IMAP and POP3 · SPF, DKIM, DMARC and ARC · Webmail and admin console · One <code>docker-compose.yaml</code>, made for Coolify.</p>
 
-<p align="center"><a href="docs/WEBMAIL.md">Webmail</a> · <a href="docs/DEPLOYMENT.md">Deploying</a> · <a href="docs/OPERATIONS.md">Operating</a> · <a href="docs/MAILBOX-CORE.md">Mailbox core</a> · <a href="LICENSE">License</a></p>
+<p align="center"><a href="docs/WEBMAIL.md">Webmail</a> · <a href="docs/DEPLOYMENT.md">Deploying</a> · <a href="docs/OPERATIONS.md">Operating</a> · <a href="docs/MAILBOX-CORE.md">Mailbox core</a> · <a href="docs/RELEASING.md">Releasing</a> · <a href="CHANGELOG.md">Changelog</a> · <a href="LICENSE">License</a></p>
 
 <p align="center"><b>English</b> · <a href="README.pt-BR.md">Português</a></p>
 
@@ -18,7 +18,7 @@ SMTP, IMAP, POP3 and ManageSieve, with SPF, DKIM, DMARC, ARC, MTA-STS and
 TLS-RPT, DNS automation through Cloudflare, and spam and virus filtering. No
 paid tiers and no artificial limits on domains or mailboxes.
 
-> **Status: pre-release.** The mail path, the security posture and the web
+> **Version 1.0.0** ([changelog](CHANGELOG.md)). The mail path, the security posture and the web
 > interfaces work end to end, and there is an automated test suite behind them.
 > See [What is not finished](#what-is-not-finished) before putting real mail
 > through it.
@@ -107,7 +107,7 @@ getting port 25 unblocked — and the order the rest has to happen in.
 The short version:
 
 ```bash
-cp .env.production.example .env      # then replace every CHANGE
+scripts/init-env.sh --production    # .env with random secrets; lists what to set
 make preflight                       # checks port 25, PTR, RBLs, token scope
 docker compose up -d
 make create-admin EMAIL=you@example.com PASSWORD='...'
@@ -166,7 +166,7 @@ more thing to keep patched.
 ## Running locally
 
 ```bash
-cp .env.example .env
+make env                             # .env from .env.example, with random secrets
 make gen-dev-cert                    # self-signed certificate for the listeners
 make up                              # builds from source via the build overlay
 make seed                            # a postmaster@example.test fixture
@@ -204,8 +204,8 @@ checked in a real browser; see
 ## Configuration
 
 Every variable is documented inline in
-[`.env.production.example`](.env.production.example). The ones without a safe
-default:
+[`.env.example`](.env.example), the one file for development and production.
+The ones without a safe default (`scripts/init-env.sh` generates the secrets):
 
 | Variable | |
 | :--- | :--- |
@@ -383,6 +383,8 @@ Stated plainly, because a mail server that half works loses mail:
   the first.
 - Tests come with the change that needs them; the suites above must stay green.
 - Commits reference their issue: `#N: what changed and why`.
+- A change someone would notice goes under *Unreleased* in [CHANGELOG.md](CHANGELOG.md)
+  (and its Portuguese twin). How a version is cut: [docs/RELEASING.md](docs/RELEASING.md).
 
 ## License