Sposta storage video su disco dedicato e completa ops/SMTP in produzione.

Recordings e Garage usano bind mount su /media/videos; aggiunge ntfy self-hosted,
notifiche critical+warning, SMTP Aruba SSL/465 e fix cron replay.

Co-authored-by: Cursor <cursoragent@cursor.com>

infra/.env.production.example

@@ -42,13 +42,15 @@ PRIVACY_CONTACT_EMAIL=privacy@matchlive.it
 PRIVACY_CONTROLLER_VAT=
 
 # Email transazionali (reset password, inviti)
-MAILER_FROM=Match Live TV <noreply@matchlive.it>
-SMTP_ADDRESS=
-SMTP_PORT=587
-SMTP_USERNAME=
+MAILER_FROM=Match Live TV <noreply@matchlivetv.it>
+# Aruba: smtps.aruba.it porta 465 con SSL (non STARTTLS su 587)
+SMTP_ADDRESS=smtps.aruba.it
+SMTP_PORT=465
+SMTP_USERNAME=noreply@matchlivetv.it
 SMTP_PASSWORD=
 SMTP_AUTH=plain
-SMTP_STARTTLS=true
+SMTP_SSL=true
+SMTP_STARTTLS=false
 PASSWORD_RESET_EXPIRY_HOURS=2
 
 # Disco video dedicato (recordings MediaMTX + dati Garage). Montare es. 800GB su /media/videos
@@ -63,12 +65,16 @@ REPLAY_STORAGE_ACCESS_KEY_ID=
 REPLAY_STORAGE_SECRET_ACCESS_KEY=
 REPLAY_STORAGE_FORCE_PATH_STYLE=true
 
-# Ops monitoring — notifiche push (ntfy) e health check
-# App ntfy: https://ntfy.sh — iscriviti al topic e imposta OPS_NTFY_URL
-OPS_NTFY_URL=https://ntfy.sh/matchlivetv-ops-YOUR_SECRET_TOPIC
+# Ops monitoring — notifiche push (ntfy self-hosted) e health check
+# 1) Avvia servizio: docker compose up -d ntfy
+# 2) NPM: proxy HTTPS → http://192.168.1.146:8090 (es. ntfy.matchlivetv.it, WebSockets ON)
+# 3) App ntfy sul telefono: server custom = NTFY_PUBLIC_URL, iscriviti a OPS_NTFY_TOPIC
+NTFY_PUBLIC_URL=https://ntfy.matchlivetv.it
+# Topic segreto: stesso nome in app ntfy (subscribe) e in OPS_NTFY_URL
+OPS_NTFY_URL=http://ntfy:80/matchlivetv-ops-YOUR_SECRET_SUFFIX
 OPS_NTFY_TOKEN=
 OPS_ALERT_EMAIL=
-OPS_NOTIFY_SEVERITIES=critical
+OPS_NOTIFY_SEVERITIES=critical,warning
 OPS_NOTIFY_COOLDOWN_MINUTES=30
 OPS_HEALTH_INTERVAL_SECS=180
 OPS_HEALTH_TOKEN=