Fix[4062]: Hardcoded InsecureSkipVerify in SMTP Client

[VishalDalwadi]

Describe your changes

Fix for #4062

Provide Issue ticket number if applicable/not in title

Provide testing steps

Checklist before requesting a review

• My changes affect only 10 files or less.
• I have performed a self-review of my code and tested it.
• If it is a new feature, I have added thorough tests, my code is <= 1450 lines.
• If it is a bugfix, my code is <= 200 lines.
• My functions are <= 80 lines.
• I have had my code reviewed by a peer.
• My unit tests pass locally.
• Netmaker is awesome.

[tenki-reviewer]

Review Complete
No issues found!

Risk: 🟢 Low (10/100) — no findings · 9 LOC across 4 files

---

This PR fixes a pre-existing security vulnerability where SMTP TLS verification was hardcoded to disabled (InsecureSkipVerify: true) by making it configurable. The change is a clear improvement — the secure default (false) now applies — with one minor gap: the new setting cannot be initialized from environment variables at startup.

Files Reviewed (4 files)

logic/settings.go
models/settings.go
pro/email/email.go
pro/email/smtp.go