fix: declare gen_smtp as a runtime application dependency

[Taure]

Summary

• hikyaku_adapter_smtp calls gen_smtp_client:send_blocking/2 and mimemail:encode/1, both from gen_smtp.
• gen_smtp was only declared as a rebar build dependency, never listed in hikyaku.app.src's applications list.
• relx resolves release contents from each app's applications list, so gen_smtp compiled fine but was never bundled into any release built from this library.
• Result: error:undef the first time hikyaku_adapter_smtp:deliver/2 actually ran in a deployed release (surfaced in asobi_saas production today, first real exercise of the SMTP adapter since it was written).

Test plan

• rebar3 fmt --check clean
• rebar3 xref clean (only pre-existing deprecation warnings in ranch/gen_smtp internals, not introduced by this change)
• rebar3 eunit - 75 tests, 0 failures
• rebar3 dialyzer clean
• Downstream: bump asobi_saas's pinned hikyaku ref and confirm a real SMTP send succeeds in production

[github-actions]

🟡 Code Coverage — 78%

284 of 364 lines covered.

---

ℹ️ 30 OTP CVEs auto-ignored (already fixed in running version)

These CVEs are patched in the installed OTP version but NVD data
has not been updated to reflect this. They are excluded from the
scan via an auto-generated .trivyignore.

CVE	Details
CVE-2026-55952	Fixed in 28.5.0.3, running 28.5.0.3 — Denial-of-Service for TLS-1.3 server Using Session Tickets
CVE-2026-55950	Fixed in 28.5.0.3, running 28.5.0.3 — DTLS Denial of Service
CVE-2026-54891	Fixed in 28.5.0.3, running 28.5.0.3 — Plaintext Injection Towards (D)TLS Client During Handshake
CVE-2026-54886	Fixed in 28.5.0.3, running 28.5.0.3 — SSH SFTP server denial of service via extended data infinite loop
CVE-2026-54887	Fixed in 28.5.0.3, running 28.5.0.3 — DTLS Cookie Bypass During Startup
CVE-2026-53422	Fixed in 28.5.0.3, running 28.5.0.3 — OTP ssh_sftpd REALPATH Path Existence Oracle ( File system Enumeration )
CVE-2026-49760	Fixed in 28.5.0.2, running 28.5.0.3 — Stack Buffer Overflow in ei_s_print_term at Very Large Integer
CVE-2026-49759	Fixed in 28.5.0.2, running 28.5.0.3 — Unbounded Stack Buffer Overflow in SCTP Error Cause Parsing in inet_drv
CVE-2026-48858	Fixed in 28.5.0.2, running 28.5.0.3 — FTP Client PASV Response IP not Validated Against Control Peer, Enabling SSRF and FTP Bounce Attacks
CVE-2026-48860	Fixed in 28.5.0.2, running 28.5.0.3 — Distribution-over-TLS LAN Allowlist is Silently Bypassed
CVE-2026-48856	Fixed in 28.5.0.2, running 28.5.0.3 — httpc leaks Authorization header to cross-origin redirect targets
CVE-2026-48855	Fixed in 28.5.0.2, running 28.5.0.3 — SFTP READLINK response leaks absolute backend filesystem path when root is configured
CVE-2026-42790	Fixed in 28.5.0.1, running 28.5.0.3 — Name Constraints and Subject CommonName Fallback in TLS hostname Verification
CVE-2026-42789	Fixed in 28.5.0.1, running 28.5.0.3 — public_key Accepts non-CA Certificate as Intermediate Issuer, Enabling Chain Forgery
CVE-2026-42791	Fixed in 28.5.0.1, running 28.5.0.3 — OCSP Responder Certificate Accepted After Expiry in public_key
CVE-2026-32147	Fixed in 28.4.3, running 28.5.0.3 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot
CVE-2026-28808	Fixed in 28.4.2, running 28.5.0.3 — ScriptAlias CGI targets bypass directory auth (mod_auth vs mod_cgi path mismatch)
CVE-2026-32144	Fixed in 28.4.2, running 28.5.0.3 — OCSP designated-responder authorization bypass — missing signature verification (RFC 6960 §4.2.2.2)
CVE-2026-28810	Fixed in 28.4.2, running 28.5.0.3 — Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver
CVE-2026-23943	Fixed in 28.4.1, running 28.5.0.3 — Pre-auth SSH DoS via unbounded zlib inflate
CVE-2026-23942	Fixed in 28.4.1, running 28.5.0.3 — SFTP root escape via component-agnostic prefix check in ssh_sftpd
CVE-2026-23941	Fixed in 28.4.1, running 28.5.0.3 — Request smuggling via first-wins Content-Length parsing in inets httpd
CVE-2026-21620	Fixed in 28.3.2, running 28.5.0.3 — TFTP Path Traversal
CVE-2016-1000107	Fixed in 28.0.4, running 28.5.0.3 — Httpd CGI Scripts Environment Variable Pollution AKA "httpoxy"
CVE-2025-58050	Fixed in 28.0.3, running 28.5.0.3 — Buffer Read Overflow on Regular Expressions with (*scs:) and (*ACCEPT)
CVE-2025-48038	Fixed in 28.0.3, running 28.5.0.3 — SSH Unverified File Handles can Cause Excessive Use of System Resources
CVE-2025-48039	Fixed in 28.0.3, running 28.5.0.3 — SSH Unverified Paths can Cause Excessive Use of System Resources
CVE-2025-48040	Fixed in 28.0.3, running 28.5.0.3 — SSH Malicious Key Exchange Messages may Lead to Excessive Resource Consumption
CVE-2025-48041	Fixed in 28.0.3, running 28.5.0.3 — SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles
CVE-2025-4748	Fixed in 28.0.1, running 28.5.0.3 — Absolute Path in Zip Module