feat(email): the report, invites, resets and test sends go through the outbox; only it talks SMTP (#5508)

#5508 "Every other email through the outbox: weekly report, invites,
password resets, and the test buttons" (milestone 501).

- outbox.send_each queues one email per reader (claimed, so the sender
  doesn't take it too) and tries them at once, for a page that answers
  with what happened; outbox.said words the result. attempt takes a cfg
  for a test of the form's unsaved settings and returns the settled rows.
- Weekly report (scheduled and Send now) and invites: queued, tried at
  once; one the server couldn't take yet is retried for an hour. An invite
  that didn't go shows its link with the reason, as before.
- Password reset: queued in the reset link's own transaction; the sender
  delivers it on its next tick.
- Settings -> Notifications test email and a rule's Send test: queued and
  recorded with retry=False, tried once (System 156 ruling).
- Removed mail.send, notifications._send_email and _smtp_send_sync;
  dispatch_notifications is webhook only. A guard asserts only the outbox
  (and smtp_open itself) opens an SMTP connection, with a self-test.

Also fixes run 8941 (#5507's integration test): its Also-send-to
addresses were "@test", which is_real_address rightly drops; they are
example.com now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/auth/routes.py

@@ -436,7 +436,7 @@ async def forgot_post():
     accounts; every request from an address counts toward its limit."""
     from quart import current_app
     from steward.auth.throttle import reset_throttle
-    from steward.core import mail
+    from steward.core import mail, outbox
     from steward.core.audit import log_audit
     from steward.core.formatting import zone
     from steward.core.password_resets import account_for, issue, link
@@ -454,16 +454,15 @@ async def forgot_post():
             user = await account_for(db, name)
             if user is not None:
                 reset, key = await issue(db, user)
-                to, username, user_id, tz = user.email, user.username, user.id, user.time_zone
+                username, user_id = user.username, user.id
+                to = mail.Recipient(user.email, zone(user.time_zone), False, username)
+                subject, text, html = mail.reset_email(username, reset.expires_at,
+                                                       link(public_base_url(request), key), to.tz)
+                # Sent by the outbox, with the link's own transaction; the page
+                # says the same either way, and the queue records how it went.
+                outbox.enqueue(db, kind="reset", to=to, subject=subject, text=text, html=html)
     if user is None:
         return await _forgot_page(sent=True)
-    cfg = current_app.config.get("SMTP", {})
-    subject, text, html = mail.reset_email(username, reset.expires_at,
-                                           link(public_base_url(request), key), zone(tz))
-    try:
-        await mail.send(cfg, [mail.message(cfg, to, subject, text, html)])
-    except Exception as exc:                # the page still says the same; the log says why
-        current_app.logger.warning("Password reset email to %s failed: %s", to, exc)
     await log_audit(current_app, user_id, username, "user.password_reset_requested", "user", user_id,
                     detail={"address": ip})
     return await _forgot_page(sent=True)