Hetzner (and most VPS providers) block outbound 465 by default as
anti-spam policy. Port 587 with STARTTLS is open and supported by
Resend (and any standard SMTP service). The transporter code already
flips `secure: false` automatically when port != 465, so no code
change is needed — just the default.