Hetzner (and most VPS providers) block outbound 465 by default as
anti-spam policy. Port 587 with STARTTLS is open and supported by
Resend (and any standard SMTP service). The transporter code already
flips `secure: false` automatically when port != 465, so no code
change is needed — just the default.
Prevents abuse before exposing the app publicly. Limits each client IP to
20 article sends per hour. trust proxy is set so the real client IP is
used (not Nginx's loopback) once the app is behind a reverse proxy.