The header showed only a yellow dot before the site name. It now shows the
app icon, embedded in the message as an inline part (cid:inkwell-logo, the
HTML part becoming multipart/related) rather than linked: most clients block
remote images, the app fetches nothing (rule 164), and Gmail drops SVG and
data: images. The PNG is a copy of frontend/public/icon-192.png, shipped as
package data; a test keeps the two identical.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each email was a subject and a plain-text f-string at its call site.
mail_templates.py now holds one layout: the site name, a heading, the
message, a button for the link and a footer saying who sent it and why.
Every email (password reset, test, invite) is a function returning its
subject, text and HTML. mailer.send sends them as multipart/alternative,
text first.
The HTML is email-shaped: tables, inline styles, no images or fonts, and
every value from settings or a person escaped.
POST /api/invites takes send_email. It is refused before anything is made
when email is off or the invite names no address. The link is built from
the public address. A failed send leaves the invite standing with
email_error, so the admin still gets the link once. The invite form offers
"Email the link to …" when email is on and an address is filled in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>