mail skill: use maildb wrapper on mysql host, drop inline password

.claude/skills/mail/SKILL.md

@@ -49,10 +49,13 @@ Cert: `mail.etersoft.ru` + 15 SAN (autoconfig/autodiscover/imap.*/smtp.* over et
 - amavis on as.office.etersoft.ru (10.20.30.210)
 
 ## MySQL
+The `mail` DB lives on **mysql.auth.etersoft.ru** (CT 219, 10.20.30.202). Access via the on-host wrapper — **no password needed** (creds live in `/root/.my.cnf.mail`, root-only):
 ```
-mysql --skip-ssl -h mysql.auth.dmz.etersoft.ru -u mail -p'VaQLNsXnyp3KVK4e' mail
+ssh root@mysql.auth.etersoft.ru maildb                      # interactive
+ssh root@mysql.auth.etersoft.ru maildb -e 'SELECT ...'      # one-shot query
+ssh root@mysql.auth.etersoft.ru maildb mail                  # use the mail DB
 ```
-Tables: `accountuser` (auth), `virtual` (aliases), `domain` (domains)
+(`maildb` = `mysql --defaults-extra-file=/root/.my.cnf.mail`.) Tables: `accountuser` (auth), `virtual` (aliases), `domain` (domains). To rotate the `mail` user password: change it in MySQL, then update `/root/.my.cnf.mail` **and** the `sql_passwd` in `/etc/sasl2/{saslpasswd,smtpd,Cyrus}.conf` on mail.etersoft.ru, then restart saslauthd.
 
 ## Cyrus autocreate
 `autocreate_inbox_folders: Archive|Drafts|Junk|Sent|Trash` (separator is `|`, NOT space!)