Add email-sending provider: Resend, invite-code delivery, admin notice (Plan 14)

[mbmorote]

Summary

• Builds the outbound email subsystem in the same shape as the LLM gateway: one provider seam, a Resend transport (plain fetch, zero new dependency), a gateway that gates (kill switch + hourly cap) and logs every send attempt, and never throws — an email failure can never change a caller's HTTP status.
• Wires two real triggers: auto-sending an invite code generated from an access request (with an optional sendTo on the admin's plain generate flow, and a manual resend route as the recovery path), and a fire-and-forget admin notice on a new access request that never disturbs that endpoint's byte-identical anti-enumeration response.
• Adds the admin UI (status line, Email column + Send/Resend action), corrects stale in-app copy and the privacy policy (Resend is now a named third-party processor), and updates docs (system-about.md, user-guide.md, roadmap.md, README.md, .env.example, CHANGELOG.md).
• Retires the standing rule requiring UI changes to be prototyped in Layout-Workbench.html before touching live code (renumbers the remaining CLAUDE.md standing rules).
• Archives the completed plan to plans/archive/14-email-sending-provider.md.

Test plan

• npx tsc --noEmit — clean
• npm test — 1088 tests passing, including new coverage for the gateway, provider, templates, the architecture fitness function, and all three wired routes' email behavior
• Live-verified against a real Resend account and inbox: invite-code delivery and the admin access-request notice, both through the actual gateway/routes, including one deliberate induced failure
• Manual visual check of the new Settings UI (status line, Email column, Send/Resend action) in a browser — not yet done by a human

🤖 Generated with Claude Code

https://claude.ai/code/session_0161C4FPAJerdFRSERiVZYn9