feat(email): each account gets its own email, in its own zone (milestone 495)

Milestone 495 "Email goes to each account, in its own time zone", on the
operator's ruling (System 156): notifications go to each user, times in
their zone, defaults on, toggled per user or per role.

- users.notify_alerts / notify_report (migration 0036): None follows the
  role's default, notify.<kind>.<role> in settings, all on to start.
- mail.pick_recipients: active accounts that want the email and have an
  address mail can reach (an SSO placeholder like name@oidc is skipped and
  flagged), each in its own zone with no UTC beside it, then the Also send
  to addresses in their chosen zone with UTC beside. One copy per address,
  all over one SMTP connection.
- Alerts, the weekly report and the test email (to you, in your zone, plus
  the typed addresses) send that way. The save-time smtp.tz capture is gone.
- Notifications: a role × email table of defaults, who each email reaches
  and who can't be reached, and Also send to with its own zone, which starts
  as the first admin's to open the page.
- Account page: your address and your two switches. Users: an Emailed
  column, and an admin sets an account's switches on its page.
- The Alerts page counts the accounts it emails. zone_select macro and
  formatting.zones_by_region shared by Account and Notifications.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/account/routes.py

@@ -2,8 +2,6 @@
 page writes its times in. Any role reaches it, for themselves only."""
 from __future__ import annotations
 
-from itertools import groupby
-
 from quart import Blueprint, abort, current_app, redirect, render_template, request, session
 
 from steward.auth.middleware import require_role
@@ -15,14 +13,6 @@ account_bp = Blueprint("account", __name__, url_prefix="/account")
 _SOURCES = {"local": "a Steward password", "ldap": "LDAP", "oidc": "single sign-on"}
 
 
-def _zones_by_region() -> list[tuple[str, list[str]]]:
-    """The Account page's choices: UTC alone, then every zone under its
-    region ('America', 'Europe', …)."""
-    named = [z for z in formatting.zone_names() if "/" in z]
-    return [("", ["UTC"])] + [(region, list(zones)) for region, zones
-                              in groupby(named, key=lambda z: z.split("/", 1)[0])]
-
-
 async def _me(db) -> User:
     # A share link opens widgets read-only; it has no account.
     user_id = session.get("user_id")
@@ -36,14 +26,18 @@ async def _me(db) -> User:
 
 @account_bp.get("/")
 @require_role(UserRole.viewer)
-async def account(error: str | None = None, status: int = 200):
+async def account(error: str | None = None, status: int = 200, email_error: str | None = None):
+    from steward.core.mail import role_defaults
+    from steward.core.settings import get_all_settings
     async with current_app.db_sessionmaker() as db:
         user = await _me(db)
+        defaults = role_defaults(user, await get_all_settings(db))
     tz = formatting.zone(user.time_zone)
     return await render_template(
         "account/index.html", user=user, source=_SOURCES.get(user.auth_source, user.auth_source),
         zone_name=user.time_zone or "UTC", zone_label=formatting.tz_label(tz),
-        zones=_zones_by_region(), error=error), status
+        zones=formatting.zones_by_region(), defaults=defaults, error=error,
+        email_error=email_error), status
 
 
 @account_bp.post("/")
@@ -65,6 +59,31 @@ async def account_save():
     return redirect("/account/")
 
 
+@account_bp.post("/email")
+@require_role(UserRole.viewer)
+async def account_email():
+    """Your address and whether you're emailed alerts and the weekly report
+    (milestone 495)."""
+    from sqlalchemy.exc import IntegrityError
+    from steward.core.audit import log_audit
+    from steward.core.mail import apply_email_form
+    form = await request.form
+    try:
+        async with current_app.db_sessionmaker() as db:
+            async with db.begin():
+                user = await _me(db)
+                changes, error = apply_email_form(user, form)
+                if error:
+                    raise ValueError(error)
+    except ValueError as exc:
+        return await account(status=400, email_error=str(exc))
+    except IntegrityError:
+        return await account(status=400, email_error="Another account already uses that address.")
+    if changes:
+        await log_audit(current_app, user.id, user.username, "account.email", detail=changes)
+    return redirect("/account/#email")
+
+
 @account_bp.post("/time-zone/adopt")
 @require_role(UserRole.viewer)
 async def adopt_time_zone():