smtp-test: bypass DB, use POST fields directly for credentials

TODO.md

@@ -6,6 +6,16 @@
 - [x] Exclude `cover` file_type from public files loop (covers are banners, not content)
 - [x] Move `App::boot()` in Dispatcher to after direct-response matching (no session on media requests)
 
+## SMTP Relay — bad greeting fix
+
+- [x] Fix `$read()` loop: use `!== false` so empty lines don't terminate early; check `timed_out` meta
+- [x] Add SSL stream context (`verify_peer=false`) to `stream_socket_client` to avoid CA bundle failures
+- [x] Improve "bad greeting" error: distinguish timeout vs garbage response in log message
+
+## Bug Fixes
+
+- [x] Fix `RateLimit::check()` called statically in `request-access.php` — replaced with `(new RateLimit(3, 600))->checkKey($rateLimitKey)`
+
 ## Dev / Debug Fixes
 
 - [x] Fix `serve` recipe: show all PHP output (errors, logs) except static assets/connection noise