Transactional Email

Synced with starter commit 7d452a6.

Resend and React Email are already integrated. Set RESEND_API_KEY and a verified EMAIL_FROM. Configure SPF and DKIM, then add DMARC for production.

Templates cover verification, password reset, welcome, payment success/failure, reservation confirmation, and organization invitations. Customize templates under src/services/email/ and keep delivery orchestration in services.

Auth links may be logged locally when no provider is configured or AUTH_DEV_EMAIL_LINKS=true; production rejects this escape hatch. Product email is queued as durable work and uses the job UUID as the provider idempotency key, so retry does not create duplicate delivery. Keep /api/cron/jobs running and alert on degraded readiness or exhausted jobs.

Do not fire-and-forget a promise from a route and do not add a public “test email” endpoint. Enqueue after the domain write, avoid secrets and unnecessary personal data in payloads, and test provider failure, retry, duplicate execution, suppression/blocklist behavior, and translated links.