release: 1.0.0, a changelog, one .env.example and the docs to match

- CHANGELOG.md and CHANGELOG.pt-BR.md, from the project history.
- .env.example now serves development and production; scripts/init-env.sh
  (make env) creates .env with random secrets. .env.production.example is gone.
- docs/RELEASING.md: the pipeline, how a version is cut and deployed, the runners.
- DEPLOYMENT.md and both READMEs updated for Gitea and the new env flow.
- Service versions set to 1.0.0.
- CI: the proxy network step is idempotent and the stack is torn down always,
  since the runner's Docker daemon now outlives a job.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/init-env.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Creates .env from .env.example and fills the empty secrets with random values.
+#
+#   scripts/init-env.sh                 local development
+#   scripts/init-env.sh --production    also lists what is still at a dev default
+#   scripts/init-env.sh --force         overwrite an existing .env
+#
+# An existing .env is never touched without --force: regenerating
+# LAMBDAMAIL_MASTER_KEY makes every stored secret unrecoverable.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+production=0
+force=0
+for arg in "$@"; do
+  case "$arg" in
+    --production) production=1 ;;
+    --force) force=1 ;;
+    -h|--help) sed -n '2,10p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    *) echo "unknown option: $arg" >&2; exit 2 ;;
+  esac
+done
+
+if [ -e .env ] && [ "$force" -ne 1 ]; then
+  echo ".env already exists; leaving it alone (use --force to overwrite)." >&2
+  exit 1
+fi
+
+command -v openssl >/dev/null || { echo "openssl is required to generate secrets" >&2; exit 1; }
+
+cp .env.example .env
+chmod 600 .env
+
+# set_var KEY VALUE: replaces the line KEY=... in .env. The value is hex, so it
+# needs no escaping for sed.
+set_var() {
+  sed -i.bak "s|^$1=.*|$1=$2|" .env && rm -f .env.bak
+}
+
+set_var POSTGRES_PASSWORD "$(openssl rand -hex 24)"
+set_var REDIS_PASSWORD "$(openssl rand -hex 24)"
+set_var JWT_SECRET "$(openssl rand -hex 32)"
+set_var LAMBDAMAIL_MASTER_KEY "$(openssl rand -hex 32)"
+
+echo ".env written (mode 600) with fresh secrets."
+
+if [ "$production" -eq 1 ]; then
+  set_var COOLIFY_PROXY_DIR /data/coolify/proxy
+  echo
+  echo "Production: still at their development defaults, set these in .env:"
+  pending=0
+  check() {
+    if grep -qE "^$1=$2\$" .env; then echo "  - $1 (now $2)"; pending=1; fi
+  }
+  check MAIL_DOMAIN localhost
+  check PRIMARY_MAIL_HOST mail.localhost
+  check WEBMAIL_HOST 'localhost:3000'
+  check PUBLIC_IPV4 127.0.0.1
+  check IMAGE_TAG latest
+  [ "$pending" -eq 0 ] && echo "  (nothing)"
+  echo
+  echo "Back up LAMBDAMAIL_MASTER_KEY separately from the database."
+  echo "Next: make preflight, then docker compose up -d (docs/DEPLOYMENT.md)."
+fi