Fix deploy script to preserve manually set FASTMAIL env vars

The deploy script was unconditionally writing FASTMAIL_API_TOKEN,
FASTMAIL_FROM_EMAIL, and FASTMAIL_FROM_NAME to .env, even when the
GitHub Actions secrets were empty. This overwrote manually-set values.

Now these values are only written if the secrets are non-empty.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/auth_build.yml

@@ -141,13 +141,35 @@ jobs:
               # Update JWT private key (JWK format for auth service bootstrap)
               grep -v '^JWT_PRIVATE_KEY=' .env.tmp5 > .env.tmp6 || true
               echo "JWT_PRIVATE_KEY=${JWT_PRIVATE_KEY:-}" >> .env.tmp6
-              # Update Fastmail JMAP credentials for email sending
-              grep -v '^FASTMAIL_API_TOKEN=' .env.tmp6 > .env.tmp7 || true
-              echo "FASTMAIL_API_TOKEN=${FASTMAIL_API_TOKEN:-}" >> .env.tmp7
-              grep -v '^FASTMAIL_FROM_EMAIL=' .env.tmp7 > .env.tmp8 || true
-              echo "FASTMAIL_FROM_EMAIL=${FASTMAIL_FROM_EMAIL:-}" >> .env.tmp8
-              grep -v '^FASTMAIL_FROM_NAME=' .env.tmp8 > .env || true
-              echo "FASTMAIL_FROM_NAME=${FASTMAIL_FROM_NAME:-}" >> .env
+              # Update Fastmail JMAP credentials for email sending (only if set)
+              # Debug: show whether env vars are set (not their values)
+              echo "FASTMAIL_API_TOKEN set: $([ -n "${FASTMAIL_API_TOKEN:-}" ] && echo 'yes' || echo 'no')"
+              echo "FASTMAIL_FROM_EMAIL set: $([ -n "${FASTMAIL_FROM_EMAIL:-}" ] && echo 'yes' || echo 'no')"
+              echo "FASTMAIL_FROM_NAME set: $([ -n "${FASTMAIL_FROM_NAME:-}" ] && echo 'yes' || echo 'no')"
+
+              cp .env.tmp6 .env.tmp7
+              if [ -n "${FASTMAIL_API_TOKEN:-}" ]; then
+                grep -v '^FASTMAIL_API_TOKEN=' .env.tmp7 > .env.tmp7a || true
+                # Use printf with %s to avoid shell interpretation of special chars
+                printf 'FASTMAIL_API_TOKEN=%s\n' "${FASTMAIL_API_TOKEN}" >> .env.tmp7a
+                mv .env.tmp7a .env.tmp7
+              fi
+              cp .env.tmp7 .env.tmp8
+              if [ -n "${FASTMAIL_FROM_EMAIL:-}" ]; then
+                grep -v '^FASTMAIL_FROM_EMAIL=' .env.tmp8 > .env.tmp8a || true
+                printf 'FASTMAIL_FROM_EMAIL=%s\n' "${FASTMAIL_FROM_EMAIL}" >> .env.tmp8a
+                mv .env.tmp8a .env.tmp8
+              fi
+              cp .env.tmp8 .env
+              if [ -n "${FASTMAIL_FROM_NAME:-}" ]; then
+                grep -v '^FASTMAIL_FROM_NAME=' .env > .env.tmp9 || true
+                printf 'FASTMAIL_FROM_NAME=%s\n' "${FASTMAIL_FROM_NAME}" >> .env.tmp9
+                mv .env.tmp9 .env
+              fi
+
+              # Show what ended up in .env for these vars (masked)
+              echo "Resulting .env FASTMAIL entries:"
+              grep '^FASTMAIL' .env | sed 's/=.*/=***/' || echo "(none)"
               rm -f .env.tmp .env.tmp2 .env.tmp3 .env.tmp4 .env.tmp5 .env.tmp6 .env.tmp7 .env.tmp8
               chmod 600 .env
             else