chore(release): v1.0.5.1 — dev SMTP ergonomics hotfix

A fresh clone + `cp veza-backend-api/.env.template .env` + `make dev-full`
booted the backend with `SMTP_HOST=""` — `EmailService.sendEmail` short-
circuits to log-only when the host is empty, so `register` + `password
reset` produced users stuck with no way to verify (or recover) in dev,
and the smoke test caught MailHog empty despite the service being up.

- `.env.template` now ships MailHog-ready defaults (`localhost:1025`,
  UI on `:8025`, `FROM_EMAIL=no-reply@veza.local`) so a bare clone +
  copy gives a working register flow. Comment rewritten to point at
  both the dev path and the prod override.
- Also exports duplicate variable names (`SMTP_USERNAME`, `SMTP_FROM`,
  `SMTP_FROM_NAME`) read by `internal/email/sender.go`. The two email
  services in-tree disagree on env schema (`SMTP_USER` vs
  `SMTP_USERNAME`, `FROM_EMAIL` vs `SMTP_FROM`, `FROM_NAME` vs
  `SMTP_FROM_NAME`); until v1.0.6 reconciles them, both sets are
  populated so whichever path fires finds its names.

Pure config hotfix. No code change, no migration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog - Veza
 
+## [v1.0.5.1] - 2026-04-16
+
+### Hotfix — dev SMTP ergonomics
+
+Follow-up to the v1.0.5 smoke test: a fresh clone + `cp .env.template .env`
++ `make dev-full` produced a backend with `SMTP_HOST=""`, which silently
+short-circuits `EmailService.sendEmail` to a log-only path. New
+contributors hit register → "where's my verification email?" and had no
+obvious cue that the SMTP hookup was missing.
+
+- `veza-backend-api/.env.template`: `SMTP_HOST` / `SMTP_PORT` now default
+  to the MailHog instance that ships with `make infra-up-dev`
+  (`localhost:1025`, UI on `:8025`). `FROM_EMAIL` / `FROM_NAME` seeded
+  with local-safe values. Comment rewritten to point at both the dev
+  path and the prod override.
+- Also exports the duplicate variable names (`SMTP_USERNAME`, `SMTP_FROM`,
+  `SMTP_FROM_NAME`) read by `internal/email/sender.go` — a TODO flagged
+  for v1.0.6 to reconcile the two email services onto a single env
+  schema. Until then both sets cover every code path.
+
+No code change, no migration, no version bump in the Go module. Pure
+config hotfix.
+
 ## [v1.0.5] - 2026-04-16
 
 ### Hardening sprint — seven critical-path fixes before public opening

VERSION

@@ -1 +1 @@
-1.0.5
+1.0.5.1

veza-backend-api/.env.template

@@ -113,13 +113,25 @@ FRONTEND_URL=http://veza.fr:5173
 # Public base URL of this backend (used for OAuth callbacks, etc.)
 BASE_URL=http://veza.fr:8080
 
-# --- EMAIL (OPTIONAL) ---
-# Required if email verification / password reset enabled
-SMTP_HOST=
-SMTP_PORT=587
+# --- EMAIL (REQUIRED for registration + password reset) ---
+# Local dev: MailHog ships with `make infra-up-dev` — the defaults below
+# point at it on localhost:1025, with the web UI at http://localhost:8025
+# to inspect captured emails.
+# Production: override with your SMTP provider (SendGrid, AWS SES, etc.).
+#
+# TODO(v1.0.6): internal/services/email_service.go and internal/email/sender.go
+# read different variable names for the same fields (`SMTP_USER` vs
+# `SMTP_USERNAME`, `FROM_EMAIL` vs `SMTP_FROM`, `FROM_NAME` vs `SMTP_FROM_NAME`).
+# Both sets are exported here until the two services are reconciled.
+SMTP_HOST=localhost
+SMTP_PORT=1025
+SMTP_USER=
 SMTP_USERNAME=
 SMTP_PASSWORD=
-SMTP_FROM=noreply@veza.com
+FROM_EMAIL=no-reply@veza.local
+FROM_NAME=Veza (dev)
+SMTP_FROM=no-reply@veza.local
+SMTP_FROM_NAME=Veza (dev)
 
 # --- MONITORING (OPTIONAL) ---
 PROMETHEUS_URL=