feat(email): every email is a row in email_outbox until the server accepts it (#5506)

#5506 "Email outbox: a table of outgoing email and a sender that retries
until accepted, for up to an hour" (milestone 501).

- email_outbox (migration 0042) holds each message per recipient, its
  words, its state (held / pending / sending / sent / failed), attempts and
  the server's last answer. email_outbox_events links alert events for
  #5507.
- core/outbox.py: enqueue; a sender task every 15 s claims what is due
  (SKIP LOCKED, stale claims released), sends the batch over one
  connection with no session held, and settles each row:
  - accepted -> sent;
  - a 5xx refusal -> failed at once with the server's words;
  - no connection, a timeout, a 4xx -> retried after 30 s, 1, 2, 5, 10,
    15 min, the last try at the hour, then failed;
  - a test (retry=False) settles on its first answer.
  It runs on startup, so a row left by a restart goes out at boot.
- notifications.smtp_open is the one place a connection is opened.
- mail.message takes the html part as optional.
- cleanup ages email_outbox rows on the data window.

Senders move onto it in #5507 and #5508.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/core/mail.py

@@ -180,14 +180,15 @@ def sender(cfg: dict) -> str:
     return cfg.get("from") or cfg.get("username") or "steward@localhost"
 
 
-def message(cfg: dict, to: str, subject: str, text: str, html: str) -> EmailMessage:
+def message(cfg: dict, to: str, subject: str, text: str, html: str | None = None) -> EmailMessage:
     msg = EmailMessage()
     # A header may not hold a line break; a rule name can (MCP takes any string).
     msg["Subject"] = " ".join(subject.split())
     msg["From"] = sender(cfg)
     msg["To"] = to
     msg.set_content(text)
-    msg.add_alternative(html, subtype="html")
+    if html:
+        msg.add_alternative(html, subtype="html")
     return msg