feat(email): the report, invites, resets and test sends go through the outbox; only it talks SMTP (#5508)

#5508 "Every other email through the outbox: weekly report, invites,
password resets, and the test buttons" (milestone 501).

- outbox.send_each queues one email per reader (claimed, so the sender
  doesn't take it too) and tries them at once, for a page that answers
  with what happened; outbox.said words the result. attempt takes a cfg
  for a test of the form's unsaved settings and returns the settled rows.
- Weekly report (scheduled and Send now) and invites: queued, tried at
  once; one the server couldn't take yet is retried for an hour. An invite
  that didn't go shows its link with the reason, as before.
- Password reset: queued in the reset link's own transaction; the sender
  delivers it on its next tick.
- Settings -> Notifications test email and a rule's Send test: queued and
  recorded with retry=False, tried once (System 156 ruling).
- Removed mail.send, notifications._send_email and _smtp_send_sync;
  dispatch_notifications is webhook only. A guard asserts only the outbox
  (and smtp_open itself) opens an SMTP connection, with a self-test.

Also fixes run 8941 (#5507's integration test): its Also-send-to
addresses were "@test", which is_real_address rightly drops; they are
example.com now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_notification_test_send.py

@@ -90,14 +90,14 @@ def test_test_webhook_sends_the_form_template_and_shows_the_body(app, monkeypatc
 
 
 def test_test_email_uses_the_form_settings_and_names_the_tls_mode(app, monkeypatch):
-    from steward.core import notifications
+    from steward.core import outbox
     sent = []
 
-    async def fake_send(cfg, alert, to):
-        sent.append((cfg, [r.address for r in to]))
-        return {"sent": True, "error": None}
+    def fake_deliver(cfg, messages):
+        sent.append((cfg, [m["To"] for m in messages]))
+        return [None] * len(messages)
 
-    monkeypatch.setattr(notifications, "_send_email", fake_send)
+    monkeypatch.setattr(outbox, "deliver_sync", fake_deliver)
 
     async def _go():
         client, uid = await _admin_client(app)
@@ -110,10 +110,18 @@ def test_test_email_uses_the_form_settings_and_names_the_tls_mode(app, monkeypat
         assert "alert-success" in page
         assert "Sent to a@example.com, b@example.com via mx.example:465 (implicit TLS)." in page
         assert "Rule: Test alert" in page
-        # The admin's own address (uuid@test) isn't one mail can reach, so only the typed ones.
+        # The admin's own address (uuid@test) isn't one mail can reach, so only the typed ones,
+        # sent through the queue with the form's unsaved values, recorded, and not retried.
         assert sent == [({"host": "mx.example", "port": 465, "tls": False, "username": "u",
                           "password": "pw", "from": "alerts@example.com", "base_url": ""},
                          ["a@example.com", "b@example.com"])]
+        from sqlalchemy import select
+        from steward.models.outbox import EmailOutbox
+        async with app.db_sessionmaker() as s:
+            rows = (await s.execute(select(EmailOutbox).where(
+                EmailOutbox.kind == "test", EmailOutbox.recipient.in_(["a@example.com", "b@example.com"]))
+                .order_by(EmailOutbox.created_at.desc()).limit(2))).scalars().all()
+        assert {(r.state, r.retry) for r in rows} == {("sent", False)}
 
         resp = await client.post("/settings/notifications/test-email", form={
             "smtp.host": "", "smtp.port": "587", "smtp.recipients": ""}, headers=csrf)