We don't use the Matrix-Zulip bridge anymore, and its dependency python3.14-zulip-emoji-mapping fails to build with the current nixpkgs, which blocks the flake update.

Zitadel asks every user with an unverified address (registration, all
byoidc logins) for a code before the login finishes. Without an SMTP
provider the code was never sent (Errors.SMTPConfig.NotFound) and these
users were stuck. They now come from the send-only account id@lassul.us
on the mailserver, over TLS on mail.lassul.us:465.

lass.zitadel.smtp creates, updates and activates the instance's SMTP
provider. Zitadel 2.71 skips providers without a password, so the
password comes from passwordFile; a hash of the one Zitadel has is kept
in the state directory to update it when the file changes.

find_user tried the configured name as login name first. With
UserLoginMustBeDomain off (Zitadel's default and ours), anyone who
registers picks any free username, including lass@lassul.us or the
address of someone who has not registered yet, and got the grant meant
for that address. Only a verified address cannot be claimed this way.