feat(postfix): relay SMTP Gmail + suppression règles Conan nftables

- postfix_relay: switch Brevo → Gmail SMTP (smtp.gmail.com:587, App Password)
- smtp_generic_maps: réécriture expéditeur root@lab.local → aliyesilkaya93@gmail.com
- nftables: suppression DNAT/NAT Conan Exiles (ports 7777/7778/27015)
- gateway handler: reloaded → restarted (flush complet des règles nft)
- hermes_agent: pip → uv pour installation qdrant-client (venv sans pip binaire)
- CLAUDE.md: corrections funk-cluster, hermes-switch, RAID5, postfix
- docs: admin/infra/email.md — procédure complète relay Gmail

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/gateway/handlers/main.yml

@@ -2,4 +2,4 @@
 - name: Reload nftables
   ansible.builtin.systemd:
     name: nftables
-    state: reloaded
+    state: restarted

ansible/roles/gateway/templates/nftables.conf.j2

@@ -69,6 +69,10 @@ table inet filter {
 }
 
 table ip nat {
+    chain prerouting {
+        type nat hook prerouting priority -100;
+    }
+
     chain postrouting {
         type nat hook postrouting priority 100;