feat(email): the report, invites, resets and test sends go through the outbox; only it talks SMTP (#5508)

#5508 "Every other email through the outbox: weekly report, invites,
password resets, and the test buttons" (milestone 501).

- outbox.send_each queues one email per reader (claimed, so the sender
  doesn't take it too) and tries them at once, for a page that answers
  with what happened; outbox.said words the result. attempt takes a cfg
  for a test of the form's unsaved settings and returns the settled rows.
- Weekly report (scheduled and Send now) and invites: queued, tried at
  once; one the server couldn't take yet is retried for an hour. An invite
  that didn't go shows its link with the reason, as before.
- Password reset: queued in the reset link's own transaction; the sender
  delivers it on its next tick.
- Settings -> Notifications test email and a rule's Send test: queued and
  recorded with retry=False, tried once (System 156 ruling).
- Removed mail.send, notifications._send_email and _smtp_send_sync;
  dispatch_notifications is webhook only. A guard asserts only the outbox
  (and smtp_open itself) opens an SMTP connection, with a self-test.

Also fixes run 8941 (#5507's integration test): its Also-send-to
addresses were "@test", which is_real_address rightly drops; they are
example.com now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/core/alerting.md

@@ -168,10 +168,11 @@ alert in the window, oldest first, in their own zone, with a subject like
 "[Steward] 3 alerts: 2 firing, 1 resolved". One alert on its own keeps its
 usual email.
 
-Email waits in the database (`email_outbox`, `core/outbox.py`) until the mail
-server accepts it, so nothing waiting is lost when Steward restarts: the
-sender picks it up at boot. The sender runs every 15 seconds and settles each
-email on the server's answer:
+Every email Steward sends (alerts, the weekly report, invites, password
+resets and the test buttons) waits in the database (`email_outbox`,
+`core/outbox.py`) until the mail server accepts it, so nothing waiting is lost
+when Steward restarts: the sender picks it up at boot. The sender runs every 15
+seconds and settles each email on the server's answer:
 
 - **Accepted:** sent.
 - **Refused** (an SMTP 5xx, such as "no such mailbox"): failed at once, with
@@ -183,6 +184,13 @@ email on the server's answer:
 Once every email carrying an alert has settled, that alert's event records
 whether the email went, and to whom it didn't.
 
+An email a person is waiting on is tried at once instead of on the next tick:
+the weekly report's **Send now**, an invite, and the test buttons, so the page
+can say what the server answered. A report or invite the server couldn't take
+yet stays queued and is retried as above. A test (the Settings → Notifications
+test email, a rule's **Send test**) is recorded but never retried: its one
+answer is the result.
+
 ### Webhook
 
 Configured at `/settings/` under Webhook. The body is a Jinja2 template rendered to JSON. Content-Type is always `application/json`. If the rendered template is not valid JSON, the delivery is logged as failed and no request is sent.