Fix .env writer: quote values so shell metacharacters don't break source

deploy.sh sources .env directly as bash (`set -a; source .env`), but
setup.sh wrote raw unquoted values. The default SMTP_FROM ("ANOUMA
<no-reply@...>") contains `<`/`>`, which bash parses as redirections,
failing with "syntax error near unexpected token `newline'" on every
deploy. Both scripts' env_set now write double-quoted values with
backslashes/quotes escaped — valid for both `source` and Docker
Compose's env_file parsing (which strips matching quotes).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy.sh

@@ -61,13 +61,19 @@ trap 'rm -f "$LOCK_FILE"' EXIT
 # .env helpers — same idempotent read/write approach as setup.sh.
 # ---------------------------------------------------------------------------
 env_get() { grep -E "^$1=" .env 2>/dev/null | tail -n1 | cut -d'=' -f2- || true; }
+# Quoted the same way as setup.sh's env_set — this file is `source`d as a
+# bash script below, so an unquoted value with shell metacharacters would
+# break parsing.
 env_set() {
-  local key="$1" value="$2"
+  local key="$1" value="$2" escaped quoted
+  escaped="${value//\\/\\\\}"
+  escaped="${escaped//\"/\\\"}"
+  quoted="\"${escaped}\""
   if grep -qE "^$key=" .env; then
     local tmp; tmp="$(mktemp)"
-    awk -v k="$key" -v v="$value" 'BEGIN{FS=OFS="="} $1==k{$0=k "=" v} {print}' .env > "$tmp" && mv "$tmp" .env
+    awk -v k="$key" -v v="$quoted" 'BEGIN{FS=OFS="="} $1==k{$0=k "=" v} {print}' .env > "$tmp" && mv "$tmp" .env
   else
-    printf '%s=%s\n' "$key" "$value" >> .env
+    printf '%s=%s\n' "$key" "$quoted" >> .env
   fi
 }