feat(email): every email is a row in email_outbox until the server accepts it (#5506)

#5506 "Email outbox: a table of outgoing email and a sender that retries
until accepted, for up to an hour" (milestone 501).

- email_outbox (migration 0042) holds each message per recipient, its
  words, its state (held / pending / sending / sent / failed), attempts and
  the server's last answer. email_outbox_events links alert events for
  #5507.
- core/outbox.py: enqueue; a sender task every 15 s claims what is due
  (SKIP LOCKED, stale claims released), sends the batch over one
  connection with no session held, and settles each row:
  - accepted -> sent;
  - a 5xx refusal -> failed at once with the server's words;
  - no connection, a timeout, a 4xx -> retried after 30 s, 1, 2, 5, 10,
    15 min, the last try at the hour, then failed;
  - a test (retry=False) settles on its first answer.
  It runs on startup, so a row left by a restart goes out at boot.
- notifications.smtp_open is the one place a connection is opened.
- mail.message takes the html part as optional.
- cleanup ages email_outbox rows on the data window.

Senders move onto it in #5507 and #5508.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/app.py

@@ -438,7 +438,21 @@ def _register_core_tasks(app: Quart) -> None:
         from .core.self_monitor import record_self_metrics
         await record_self_metrics(app)
 
+    async def run_email_outbox():
+        from .core.outbox import send_due
+        await send_due(app)
+
+    from .core.outbox import SENDER_TICK_S
     app._task_registry.extend([
+        # Every email is a row until the mail server accepts it (#5506); this
+        # sends what is due and retries what failed. On startup too, so what a
+        # restart left unsent goes out at once.
+        ScheduledTask(
+            name="email_outbox",
+            coro_factory=run_email_outbox,
+            interval_seconds=SENDER_TICK_S,
+            run_on_startup=True,
+        ),
         ScheduledTask(
             name="weekly_report_check",
             coro_factory=run_report_check,