Fix mail config not reaching vm420 + let admins view/set a user's email

docker-compose.yml (the file vm420 actually runs, not
docker-compose.prod.yml) hardcoded MAIL_HOST=mailhog and
MAIL_SMTP_AUTH=false with no way to override from .env, and never
passed MAIL_USERNAME/MAIL_PASSWORD through at all - so setting real
values in .env silently had no effect on the running container.
Registrations succeeded and created accounts, but the password email
was never actually sent (PHPMailer tried to reach a nonexistent
"mailhog" host inside vm420's network). Switched to
${MAIL_HOST:-mailhog}-style fallbacks, same pattern already used for
DATABASE_PASSWORD, so local dev still defaults to mailhog for free
while a real .env override now actually takes effect.

Separately: the admin-panel user form never had an email field at
all (only register.php could set one) - a superadmin had no way to
view or correct a self-registered user's email address. Added the
field (optional, uniqueness-checked, defaults to forcing
must_set_email on next login if left blank) to form_users.php,
Users::addUser()/editUser(), and the users list/table.

docker-compose.yml

@@ -16,10 +16,17 @@ services:
       DATABASE_PREFIX: "${DATABASE_PREFIX:-}"
       DATABASE_CHARSET: "${DATABASE_CHARSET:-utf8}"
       ALLOW_SELF_REGISTRATION: "${ALLOW_SELF_REGISTRATION:-false}"
-      MAIL_HOST: "mailhog"
-      MAIL_PORT: "1025"
-      MAIL_ENCRYPTION: ""
-      MAIL_SMTP_AUTH: "false"
+      # This file is also what vm420 runs in production (not docker-compose.prod.yml -
+      # see the "prod" naming is misleading, this is the actually-deployed one). Defaults
+      # here are dev-convenience only (mailhog, no auth) - a real deployment's .env must
+      # override MAIL_HOST/MAIL_SMTP_AUTH/MAIL_USERNAME/MAIL_PASSWORD explicitly, same as
+      # DATABASE_PASSWORD above already requires.
+      MAIL_HOST: "${MAIL_HOST:-mailhog}"
+      MAIL_PORT: "${MAIL_PORT:-1025}"
+      MAIL_ENCRYPTION: "${MAIL_ENCRYPTION:-}"
+      MAIL_SMTP_AUTH: "${MAIL_SMTP_AUTH:-false}"
+      MAIL_USERNAME: "${MAIL_USERNAME:-}"
+      MAIL_PASSWORD: "${MAIL_PASSWORD:-}"
       MAIL_FROM_ADDRESS: "${MAIL_FROM_ADDRESS:-noreply@example.com}"
       MAIL_FROM_NAME: "${MAIL_FROM_NAME:-QRForge}"
     ports: