fix(#784): /contact/ offers a channel that works without a third-party key

[TortoiseWolfe]

The defect

Production shipped an empty Web3Forms access key:

$ curl …/_next/static/chunks/app/contact/page-f4f80d62d04f8012.js
accessKey(){return""
accessKey)throw Error("Web3Forms access key is no…

So every submission threw. There was no EmailJS fallback (no service_… id in any of
the 15 chunks on that page) and no mailto: anywhere on /contact/ — the form was
the entire channel, and the form could not send.

Meanwhile Stripe's live business_profile reads:

support_url   : https://scripthammer.com/contact/
support_email : admin@scripthammer.com

Receipts send paying customers to that page. They arrived at a form that errored, on a
page that never showed them the address that actually works.

The fix: offer something that does not depend on a credential

An address works whether or not a third-party key is present. Two placements:

• "Other Ways to Connect", listed first, above the GitHub links.
• Inside the form's error alert. That branch renders at the precise moment a
  visitor's message did not get through. "Something went wrong" and nothing else is how
  an enquiry is lost silently.

admin@scripthammer.com was proven to deliver end-to-end today — a message sent through
Resend → Cloudflare Email Routing arrived in the destination inbox — rather than being
assumed from correct-looking DNS.

The default is the load-bearing part

supportEmail reads NEXT_PUBLIC_SUPPORT_EMAIL and defaults to empty; the mailto is
not rendered when unset.

Hardcoding an address would put this maintainer's inbox on every fork's contact page —
the #392 failure, one person's identity shipped to everyone, reappearing on the exact
page customers are directed to.

Three tests assert it, and they were mutation-tested: giving supportEmail a
hardcoded fallback turns all three red. One states the rule as a property —
not.toMatch(/@/) — so any future default fails, whichever address someone picks.

Worth recording: the first mutation attempt was a sed whose | delimiter collided
with ||. It silently did not apply and the suite went green — a proof that proved
nothing. Grepping the file afterwards is what caught it. Confirm the mutant is really
in the file before trusting the red.

Notes

• !text-current on the in-alert link: the alert owns the colour on its own surface, and
  a link colour of its own measured 1.66:1 there (The AAA contrast gate counts unmeasured elements as passes — 20% of them #459).
• NEXT_PUBLIC_SUPPORT_EMAIL is a variable, not a secret — it is rendered on the page
  for anyone to read, and it needs to be auditable. Same reasoning as the Stripe
  publishable key in fix(#629): make the Stripe publishable key auditable before the go-live flip, not during it #785.
• Documented in .env.example, so the .env.example is the fork's config contract, and nine variables are missing from it — including the PayPal name that already caused a 500 and the captcha key from #353 #771 code→docs guard passes.
• The repo variable is already set to admin@scripthammer.com.

Still outstanding on #784

The Web3Forms access key itself — that is the owner's account. This change means the
page has a working channel regardless. When the key is set, deploy.yml also needs its
secrets.NEXT_PUBLIC_WEB3FORMS_ACCESS_KEY reference switched to vars., the same swap
#785 makes for Stripe.

Refs #784