feat(email): the report, invites, resets and test sends go through the outbox; only it talks SMTP (#5508)

#5508 "Every other email through the outbox: weekly report, invites,
password resets, and the test buttons" (milestone 501).

- outbox.send_each queues one email per reader (claimed, so the sender
  doesn't take it too) and tries them at once, for a page that answers
  with what happened; outbox.said words the result. attempt takes a cfg
  for a test of the form's unsaved settings and returns the settled rows.
- Weekly report (scheduled and Send now) and invites: queued, tried at
  once; one the server couldn't take yet is retried for an hour. An invite
  that didn't go shows its link with the reason, as before.
- Password reset: queued in the reset link's own transaction; the sender
  delivers it on its next tick.
- Settings -> Notifications test email and a rule's Send test: queued and
  recorded with retry=False, tried once (System 156 ruling).
- Removed mail.send, notifications._send_email and _smtp_send_sync;
  dispatch_notifications is webhook only. A guard asserts only the outbox
  (and smtp_open itself) opens an SMTP connection, with a self-test.

Also fixes run 8941 (#5507's integration test): its Also-send-to
addresses were "@test", which is_real_address rightly drops; they are
example.com now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_passwords.py

@@ -123,15 +123,14 @@ _KEY = re.compile(r"/reset/([A-Za-z0-9_-]{20,})")
 
 
 def _mail(app, monkeypatch):
-    from steward.core import mail
-    sent = []
+    from tests.integration._mail import capture
+    return capture(app, monkeypatch)
 
-    async def fake_send(cfg, messages):
-        sent.extend(messages)
 
-    app.config["SMTP"] = {"host": "mx.example", "port": 587, "from": "steward@example.com"}
-    monkeypatch.setattr(mail, "send", fake_send)
-    return sent
+async def _deliver(app):
+    """The outbox sender's next tick: a reset email is queued (#5508)."""
+    from steward.core import outbox
+    await outbox.send_due(app)
 
 
 async def _stranger(app):
@@ -158,8 +157,11 @@ def test_a_forgotten_password_is_reset_from_the_emailed_link(app, monkeypatch):
             resp = await guest.post("/forgot", headers=CSRF, form={"name": who})
             answers.append((resp.status_code, "on its way" in await resp.get_data(as_text=True)))
         assert answers == [(200, True)] * 3
-        assert [m["To"] for m in sent] == [f"{name}@example.com"]
-        text = sent[0].get_body(("plain",)).get_content()
+        await _deliver(app)
+        from tests.integration._mail import to
+        mine = to(sent, f"{name}@example.com", f"{sso_name}@example.com", f"nobody-{uid[:8]}@example.com")
+        assert [m["To"] for m in mine] == [f"{name}@example.com"]
+        text = mine[0].get_body(("plain",)).get_content()
         assert name in text and "BST" in text
         key = _KEY.search(text).group(1)
 
@@ -197,7 +199,10 @@ def test_asking_again_kills_the_first_link_and_an_old_link_expires(app, monkeypa
         guest = await _stranger(app)
         for _ in range(2):
             await guest.post("/forgot", headers=CSRF, form={"name": name})
-        first, second = (_KEY.search(m.get_body(("plain",)).get_content()).group(1) for m in sent)
+        await _deliver(app)
+        from tests.integration._mail import to
+        first, second = (_KEY.search(m.get_body(("plain",)).get_content()).group(1)
+                         for m in to(sent, f"{name}@example.com"))
         assert (await guest.get(f"/reset/{first}")).status_code == 404
         assert (await guest.get(f"/reset/{second}")).status_code == 200