docs: describe both fork changes and record public source availability

NAMAILU_FORK.md

@@ -1,4 +1,13 @@
-# Namailu fork: unified HUMAN password
+# Namailu fork of Stalwart 0.16.14
+
+Two changes on top of upstream `v0.16.14`; everything else is untouched.
+
+| area | change |
+|---|---|
+| `crates/directory/src/backend/oidc/*`, `crates/http/src/auth/authenticate.rs` | unified HUMAN password: Basic credentials are verified against the identity provider (below) |
+| `crates/http/src/request.rs` | the JMAP session document builds its URLs from the requested host (below) |
+
+## Unified HUMAN password
 
 This fork keeps the regular Stalwart OIDC Bearer flow and AppPassword flow intact,
 and adds an intentionally narrow Basic-auth bridge for HUMAN accounts.
@@ -18,6 +27,22 @@ Security properties:
 - the deployment additionally restricts the endpoint with an internal TLS
   listener, source ACL, service bearer, rate limits, and bounded Argon2 work.
 
+## JMAP session follows the requested host
+
+Upstream builds the absolute URLs in the JMAP session document (`apiUrl`,
+`uploadUrl`, `downloadUrl`, `eventSourceUrl`, websocket) from one configured
+public URL. A deployment that serves several brands on one server therefore
+tells a client that discovered the server on one hostname to continue on
+another one.
+
+With `STALWART_PUBLIC_URL_HOSTS=example.org,example.net` the session document
+follows the host the request came in on. The host header is untrusted input, so
+it is used only when it matches that allowlist exactly; anything else — including
+a spoofed `Host` — falls back to `STALWART_PUBLIC_URL`, which keeps serving the
+OAuth metadata, its issuer and the web admin links. Those must stay on one
+stable host, so they are deliberately left alone. Unset or empty keeps the
+upstream behaviour.
+
 The provided image enables the PostgreSQL metadata and S3-compatible blob
 backends used by Namailu. Build it with:
 
@@ -26,7 +51,7 @@ docker build -f Dockerfile.namailu \
   -t namailu/stalwart:v0.16.14-unified-password .
 ```
 
-The fork remains licensed under the upstream AGPL-3.0-only option. Its canonical
-source location is <https://git.facilitygo.com/filip/Stalwart>, branch
-`namailu-unified-password`. The repository is populated now and will be switched
-to public visibility before the service is opened to the public.
+The fork remains licensed under the upstream AGPL-3.0-only option. The complete
+corresponding source of the running modified version is published at
+<https://git.facilitygo.com/filip/Stalwart>, branch `namailu-unified-password`,
+which is publicly readable.