A simple approach would be to just run an IMAP server. For receiving you use a script using POP3 to download newly arrived emails (which is run every 5 minutes for example). If your server is offline, nothing gets lost.

For the sending side you can either use your mail ISP’s SMTP server directly from the client or you install a local relay as a mitm to the ISP’s SMTP.

CF is not using „their own“! The certificates the client see must be provided and authorized by the provider of the service. Or put in other words: CF is acting as the hosting provider to the outside, to the clients.

The rest of journey is „inside“ the domain of the provider of the service. It is totally normal that traffic has some journey to go and often it never touches the premises of the provider or even a server owned by the provider.

The important thing that all the part which from a customer‘s view is „internal to the provider of the service“ (behind the CF address) is responsibility of the provider of the service, no matter what 3rd party services they use.

Are you sending lots of mails to a large group of users. If not why not use any normal e-mail service like gmail?

Use an outbound tunnel like the others recommended already.

For curiosity: a mobile hotspot in my mind is a device connecting to Internet via mobile data (LTE, 5G etc) and offering a WLAN. In this case this is your router. But mobile provider often offer no public reachability at all - in which case you are back to the tunnel.

CF Tunnels. Based on a reverse proxy in the cloud with a VPN between local and CF. So different from a direct IP connection.

Or: IPv6 could be a way out.

Do you use it with a single network port or do you add interfaces, via USB? Wasn’t there a performance limitation at least on the USB ports? Maybe the 5 has better specs here?

Did you look into GL.inet routers? The have OpenWRT under the hood? At their web shop cheaper than at Amazon.

The „pg“ in pgAdmin has a meaning?