feat(email): the report, invites, resets and test sends go through the outbox; only it talks SMTP (#5508)

#5508 "Every other email through the outbox: weekly report, invites,
password resets, and the test buttons" (milestone 501).

- outbox.send_each queues one email per reader (claimed, so the sender
  doesn't take it too) and tries them at once, for a page that answers
  with what happened; outbox.said words the result. attempt takes a cfg
  for a test of the form's unsaved settings and returns the settled rows.
- Weekly report (scheduled and Send now) and invites: queued, tried at
  once; one the server couldn't take yet is retried for an hour. An invite
  that didn't go shows its link with the reason, as before.
- Password reset: queued in the reset link's own transaction; the sender
  delivers it on its next tick.
- Settings -> Notifications test email and a rule's Send test: queued and
  recorded with retry=False, tried once (System 156 ruling).
- Removed mail.send, notifications._send_email and _smtp_send_sync;
  dispatch_notifications is webhook only. A guard asserts only the outbox
  (and smtp_open itself) opens an SMTP connection, with a self-test.

Also fixes run 8941 (#5507's integration test): its Also-send-to
addresses were "@test", which is_real_address rightly drops; they are
example.com now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_alert_send_test.py

@@ -39,11 +39,8 @@ def test_send_test_reaches_each_channel_and_leaves_the_rule_alone(app, monkeypat
     from steward.models.audit import AuditEvent
     from steward.models.users import User, UserRole
 
-    emails, hooks = [], []
-
-    async def fake_email(cfg, alert, to):
-        emails.append((alert, [r.address for r in to]))
-        return {"sent": True, "error": None}
+    from tests.integration._mail import capture
+    hooks = []
 
     async def fake_hook(cfg, alert):
         hooks.append(alert)
@@ -52,10 +49,9 @@ def test_send_test_reaches_each_channel_and_leaves_the_rule_alone(app, monkeypat
     async def fake_recipients(db, kind, smtp):
         return [mail.Recipient("ann@example.com", ZoneInfo("UTC"), False, "ann")]
 
-    monkeypatch.setattr(notifications, "_send_email", fake_email)
+    emails = capture(app, monkeypatch)
     monkeypatch.setattr(notifications, "_send_webhook", fake_hook)
     monkeypatch.setattr(mail, "recipients", fake_recipients)
-    app.config["SMTP"] = {"host": "mx.example", "port": 587, "from": "alerts@example.com"}
     app.config["WEBHOOK"] = {"url": "https://hook.example/api/1"}
 
     async def _go():
@@ -83,12 +79,20 @@ def test_send_test_reaches_each_channel_and_leaves_the_rule_alone(app, monkeypat
         assert resp.status_code == 200
         page = await resp.get_data(as_text=True)
         assert "alert-error" in page
-        assert "Email sent to ann@example.com." in page
+        assert "Email: Sent to ann@example.com." in page
         assert "Webhook to hook.example failed: connection refused" in page
 
-        # What went out is this rule, marked TEST, at its latest reading.
-        ((alert, to),) = emails
-        assert to == ["ann@example.com"] and hooks == [alert]
+        # What went out is this rule, marked TEST, at its latest reading: one
+        # queued test email (recorded, not retried) and the webhook.
+        (msg,) = emails
+        (alert,) = hooks
+        assert msg["To"] == "ann@example.com" and f"Hot {tag}" in msg["Subject"]
+        from steward.models.outbox import EmailOutbox
+        async with app.db_sessionmaker() as s:
+            row = (await s.execute(select(EmailOutbox).where(
+                EmailOutbox.recipient == "ann@example.com", EmailOutbox.kind == "test",
+                EmailOutbox.subject == msg["Subject"]))).scalars().one()
+        assert (row.state, row.retry, row.attempts) == ("sent", False, 1)
         assert (alert["rule_name"], alert["state"], alert["resource"], alert["value"]) == (
             f"Hot {tag}", "TEST", host, 42.0)