feat(07-03): SettingsModule — SMTP config backend + connection test (DKV-05)

- SmtpConfigDto: host/port/encryption/username/password/fromAddress with class-validator
- SettingsService: getSmtpConfig (SMTP_SAFE_SELECT, no password), saveSmtpConfig (AES-256-GCM
  encryption via CalendarCryptoService, preserve existing password on empty), getDecryptedSmtpConfig
  (internal, used by DkvMailService), testSmtpConfig (nodemailer.verify(), returns boolean, T-07-16),
  getStartupSmtpConfig (tenant-agnostic, used by MailModule factory, D-06)
- SettingsController: GET/PUT /settings/smtp + POST /settings/smtp/test, all @Roles(ADMIN, SUPER_ADMIN)
- SettingsModule: imports CalendarModule, exports SettingsService
- AppModule: imports SettingsModule

apps/api/src/settings/settings.module.ts

@@ -0,0 +1,23 @@
+import { Module } from '@nestjs/common';
+import { CalendarModule } from '../calendar/calendar.module';
+import { SettingsController } from './settings.controller';
+import { SettingsService } from './settings.service';
+
+/**
+ * SettingsModule — manages general application settings shared across modules.
+ *
+ * Provides:
+ * - SettingsService: SmtpConfig CRUD (encrypted), connection test, startup accessor
+ * - SettingsController: REST endpoints GET/PUT /settings/smtp, POST /settings/smtp/test
+ *
+ * Imports CalendarModule to get CalendarCryptoService for AES-256-GCM encryption.
+ * PrismaModule is global — no explicit import needed.
+ * Exports SettingsService so other modules (e.g. MailModule, DkvModule) can inject it.
+ */
+@Module({
+  imports: [CalendarModule],
+  controllers: [SettingsController],
+  providers: [SettingsService],
+  exports: [SettingsService],
+})
+export class SettingsModule {}