feat(email): the report, invites, resets and test sends go through the outbox; only it talks SMTP (#5508)

#5508 "Every other email through the outbox: weekly report, invites,
password resets, and the test buttons" (milestone 501).

- outbox.send_each queues one email per reader (claimed, so the sender
  doesn't take it too) and tries them at once, for a page that answers
  with what happened; outbox.said words the result. attempt takes a cfg
  for a test of the form's unsaved settings and returns the settled rows.
- Weekly report (scheduled and Send now) and invites: queued, tried at
  once; one the server couldn't take yet is retried for an hour. An invite
  that didn't go shows its link with the reason, as before.
- Password reset: queued in the reset link's own transaction; the sender
  delivers it on its next tick.
- Settings -> Notifications test email and a rule's Send test: queued and
  recorded with retry=False, tried once (System 156 ruling).
- Removed mail.send, notifications._send_email and _smtp_send_sync;
  dispatch_notifications is webhook only. A guard asserts only the outbox
  (and smtp_open itself) opens an SMTP connection, with a self-test.

Also fixes run 8941 (#5507's integration test): its Also-send-to
addresses were "@test", which is_real_address rightly drops; they are
example.com now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/core/test_outbox.py

@@ -186,3 +186,40 @@ def test_several_alerts_are_one_email_listing_each_oldest_first():
         assert f"Agent offline: {host}" in text and f"Agent offline: {host}" in html
     assert text.index("web01") < text.index("web02") < text.index("db01")
     assert "Fri 9 Oct 2026 08:00 EDT" in text                                # the reader's zone
+
+
+def test_said_names_who_got_it_who_refused_and_who_is_still_being_tried():
+    rows = [_row(recipient="a@x", state="sent"),
+            _row(recipient="b@x", state="failed", last_error="550 no such user"),
+            _row(recipient="c@x", state="pending", last_error="451 greylisted")]
+    ok, said = outbox.said(rows)
+    assert not ok
+    assert said == ("Sent to a@x. Not sent to b@x: 550 no such user. Not sent yet to c@x "
+                    "(451 greylisted); Steward will try again for up to an hour.")
+    assert outbox.said(rows[:1]) == (True, "Sent to a@x.")
+    assert outbox.said([])[0] is False
+
+
+# The guard: every email goes through the queue (System 156 ruling), so the
+# only code that opens a connection to the mail server is the outbox's.
+def _smtp_openers(sources: dict[str, str]) -> set[str]:
+    import re
+    opens = re.compile(r"\bsmtp_open\(|\bsmtplib\.SMTP(_SSL)?\(")
+    return {path for path, src in sources.items()
+            if any(opens.search(line) and not line.lstrip().startswith(("#", "def "))
+                   for line in src.splitlines())}
+
+
+def test_only_the_outbox_talks_to_the_mail_server():
+    from pathlib import Path
+    root = Path(__file__).resolve().parents[2]          # the checkout
+    sources = {str(p.relative_to(root)): p.read_text() for p in (root / "steward").rglob("*.py")}
+    sources.update({str(p.relative_to(root)): p.read_text() for p in (root / "plugins").rglob("*.py")}
+                   if (root / "plugins").is_dir() else {})
+    assert _smtp_openers(sources) == {"steward/core/outbox.py", "steward/core/notifications.py"}
+
+
+def test_the_smtp_guard_can_fail():
+    assert _smtp_openers({"x.py": "    with smtplib.SMTP(host) as s:"}) == {"x.py"}
+    assert _smtp_openers({"y.py": "    smtp = notifications.smtp_open(cfg)"}) == {"y.py"}
+    assert _smtp_openers({"z.py": "# smtp_open(cfg) is the outbox's\ndef smtp_open(cfg):"}) == set()