feat(email): each account gets its own email, in its own zone (milestone 495)

Milestone 495 "Email goes to each account, in its own time zone", on the
operator's ruling (System 156): notifications go to each user, times in
their zone, defaults on, toggled per user or per role.

- users.notify_alerts / notify_report (migration 0036): None follows the
  role's default, notify.<kind>.<role> in settings, all on to start.
- mail.pick_recipients: active accounts that want the email and have an
  address mail can reach (an SSO placeholder like name@oidc is skipped and
  flagged), each in its own zone with no UTC beside it, then the Also send
  to addresses in their chosen zone with UTC beside. One copy per address,
  all over one SMTP connection.
- Alerts, the weekly report and the test email (to you, in your zone, plus
  the typed addresses) send that way. The save-time smtp.tz capture is gone.
- Notifications: a role × email table of defaults, who each email reaches
  and who can't be reached, and Also send to with its own zone, which starts
  as the first admin's to open the page.
- Account page: your address and your two switches. Users: an Emailed
  column, and an admin sets an account's switches on its page.
- The Alerts page counts the accounts it emails. zone_select macro and
  formatting.zones_by_region shared by Account and Notifications.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/core/test_notifications.py

@@ -2,11 +2,13 @@
 holds, SMTP picks implicit TLS / STARTTLS / plain from port and box and never
 waits without a timeout, and a webhook error never carries the URL."""
 import json
+from datetime import timezone
 
 import httpx
 import pytest
 
 from steward.core import notifications as n
+from steward.core.mail import Recipient
 
 ALERT = {"rule_name": 'Disk "root" on\nweb01 \\ backslash', "state": "FIRING", "metric": "disk_used_pct",
          "value": 93.5, "operator": ">=", "threshold": 90.0, "resource": "web01", "source_module": "host_agent",
@@ -99,21 +101,24 @@ def test_smtp_send_connects_by_mode_with_a_timeout(monkeypatch, port, tls, expec
     monkeypatch.setattr(n.smtplib, "SMTP", SMTP)
     monkeypatch.setattr(n.smtplib, "SMTP_SSL", SMTP_SSL)
     _FakeSMTP.made = []
-    msg = n.EmailMessage()
-    msg["From"] = "steward@example.com"
-    n._smtp_send_sync({"host": "mx", "port": port, "tls": tls, "username": "u", "password": "p"}, msg)
-    (smtp,) = _FakeSMTP.made
-    assert smtp.calls == expected + [("login", "u", "p"), ("send", "steward@example.com")]
+    msgs = [n.EmailMessage(), n.EmailMessage()]
+    msgs[0]["From"], msgs[1]["From"] = "steward@example.com", "other@example.com"
+    n._smtp_send_sync({"host": "mx", "port": port, "tls": tls, "username": "u", "password": "p"}, msgs)
+    (smtp,) = _FakeSMTP.made  # every message over one connection
+    assert smtp.calls == expected + [("login", "u", "p"), ("send", "steward@example.com"),
+                                     ("send", "other@example.com")]
 
 
 async def test_email_from_falls_back_and_a_line_break_in_the_name_still_sends(monkeypatch):
     sent = []
-    monkeypatch.setattr(n, "_smtp_send_sync", lambda cfg, msg: sent.append((msg["From"], msg["Subject"])))
-    base = {"host": "mx", "port": 587, "recipients": ["a@example.com"]}
+    monkeypatch.setattr(n, "_smtp_send_sync",
+                        lambda cfg, msgs: sent.extend((m["From"], m["Subject"]) for m in msgs))
+    to = [Recipient("a@example.com", timezone.utc, False)]
+    base = {"host": "mx", "port": 587}
     for cfg in ({**base, "from": "alerts@example.com", "username": "u@example.com"},
                 {**base, "from": "", "username": "u@example.com"},
                 {**base, "from": "", "username": ""}):
-        assert (await n._send_email(cfg, ALERT))["sent"]
+        assert (await n._send_email(cfg, ALERT, to))["sent"]
     assert [f for f, _ in sent] == ["alerts@example.com", "u@example.com", "steward@localhost"]
     # The rule name has a line break; the subject folds it to a space rather than failing.
     assert sent[0][1] == '[Steward] Firing: Disk "root" on web01 \\ backslash — web01 94%'