Wire CONTACT_EMAIL_PROFILES_BY_HOST into PostKit Function App settings

[patoperpetua]

Parent: #2
Imported from: singleton-sd/poc-plattform-kit#272

Goal

Make host-based PoC sender profiles work in production on the PostKit Function App without manual one-off portal edits.

Host-based overrides are resolved in @singleton-sd/post-kit-email (lifted from @poc-plattform-kit/email) when CONTACT_EMAIL_PROFILES_BY_HOST is present in the runtime environment. The PostKit Function App (ssd-postkit-api-prod-ae in rg-ssd-global) must expose that env var so Contact uses mapped sender/inbox per allowlisted Origin.

Scope

• Add CONTACT_EMAIL_PROFILES_BY_HOST to PostKit Function App infra (infra/function-app.bicep or equivalent app setting).
• Document how ops sets/updates the host map for new PoCs.
• Document example JSON for a second PoC host (e.g. InkAds) consistent with .env.example.

Out of scope:

• Nest API contact endpoint wiring in poc-plattform-kit.
• Running Forward Email domain provisioning (see the colocated provisioner issue).
• Implementing this on ssd-pocpk-decap-oauth-dev-ae / infra/decap-oauth.bicep (contact is moving off that host).

Acceptance criteria

• Deployed Function App ssd-postkit-api-prod-ae has CONTACT_EMAIL_PROFILES_BY_HOST available at runtime.
• Bicep/infra change is committed with any required deploy script notes.
• Docs describe how ops sets/updates the host map for new PoCs on the Function.
• Manual verification: Contact submit from an allowlisted Origin uses the mapped sender/inbox when configured.

Constraints

• No secrets in git or issue bodies. KV secret names only (forwardemail-api-key on ssd-global-kv-prod-ae).
• Tenant identity for phase 1 is the host-profile map; authenticated tenant resolution is later work on epic Epic: Build the multi-tenant Azure Functions email API #2.

Agent-ready checklist

• Goal and scope are clear.
• Acceptance criteria are explicit.
• Depends on: email library lift + Function App existing on main.