feat(email): the report, invites, resets and test sends go through the outbox; only it talks SMTP (#5508)

#5508 "Every other email through the outbox: weekly report, invites,
password resets, and the test buttons" (milestone 501).

- outbox.send_each queues one email per reader (claimed, so the sender
  doesn't take it too) and tries them at once, for a page that answers
  with what happened; outbox.said words the result. attempt takes a cfg
  for a test of the form's unsaved settings and returns the settled rows.
- Weekly report (scheduled and Send now) and invites: queued, tried at
  once; one the server couldn't take yet is retried for an hour. An invite
  that didn't go shows its link with the reason, as before.
- Password reset: queued in the reset link's own transaction; the sender
  delivers it on its next tick.
- Settings -> Notifications test email and a rule's Send test: queued and
  recorded with retry=False, tried once (System 156 ruling).
- Removed mail.send, notifications._send_email and _smtp_send_sync;
  dispatch_notifications is webhook only. A guard asserts only the outbox
  (and smtp_open itself) opens an SMTP connection, with a self-test.

Also fixes run 8941 (#5507's integration test): its Also-send-to
addresses were "@test", which is_real_address rightly drops; they are
example.com now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_invites.py

@@ -62,16 +62,9 @@ async def _audits(app, uid):
     return [(r.action, json.loads(r.detail_json or "{}")) for r in rows]
 
 
-def _mail(app, monkeypatch):
-    from steward.core import mail
-    sent = []
-
-    async def fake_send(cfg, messages):
-        sent.extend(messages)
-
-    app.config["SMTP"] = {"host": "mx.example", "port": 587, "from": "steward@example.com"}
-    monkeypatch.setattr(mail, "send", fake_send)
-    return sent
+def _mail(app, monkeypatch, answer=None):
+    from tests.integration._mail import capture
+    return capture(app, monkeypatch, answer)
 
 
 def test_an_invite_is_emailed_and_the_invitee_makes_their_own_account_once(app, monkeypatch):
@@ -193,3 +186,27 @@ def test_an_address_with_an_account_is_not_invited_and_only_an_admin_invites(app
                                     form={"email": "y@example.com"})).status_code == 403
 
     asyncio.run(_go())
+
+
+def test_an_invite_the_server_refuses_or_defers_shows_the_link_and_why(app, monkeypatch):
+    # Sent through the queue (#5508) and tried at once: a refusal says so; a
+    # "try later" says Steward keeps trying; either way the link is shown.
+    import smtplib
+    answers = {}
+    _mail(app, monkeypatch, lambda m: answers.get(m["To"]))
+
+    async def _go():
+        admin, aid, _ = await _admin(app)
+        refused, later = f"no-{aid[:8]}@example.com", f"later-{aid[:8]}@example.com"
+        answers[refused] = smtplib.SMTPRecipientsRefused({refused: (550, b"no such user")})
+        answers[later] = smtplib.SMTPDataError(451, b"greylisted")
+        resp = await admin.post("/settings/users/invite", headers=CSRF,
+                                form={"email": refused, "role": "viewer", "days": "7"})
+        page = await resp.get_data(as_text=True)
+        assert f"Sending to {refused} failed (550 no such user)." in page and "/invite/" in page
+        resp = await admin.post("/settings/users/invite", headers=CSRF,
+                                form={"email": later, "role": "viewer", "days": "7"})
+        page = await resp.get_data(as_text=True)
+        assert "451 greylisted" in page and "keep trying for up to an hour" in page
+
+    asyncio.run(_go())