feat(email): SMTP mailer behind the EmailService seam (EMAIL_PROVIDER=smtp); Resend stays the hosted default (#1746)

SmtpEmailService (nodemailer 9.0.5, exact-pinned) behind the existing EmailService seam. Provider resolution: EMAIL_PROVIDER wins, else RESEND_API_KEY selects Resend (hosted byte-identical), else SMTP_HOST selects SMTP. From header is built exactly like the Resend service after #1956 (no 'via <app>', fromAddress honored, platform-sender retry). STARTTLS is required by default (requireTLS) with SMTP_REQUIRE_TLS=false as an explicit opt-out for a plaintext LAN relay. Docs, env examples and the generated extension registry updated.

.env.example

@@ -108,6 +108,19 @@ RECEIPT_HUNT_COMPANY_IDS=
 # AI_STRICT_JSON=false            # openai-compatible only: response_format json_schema when the provider enforces it
 # AI_EXTRACTION_MAX_TOKENS=8192   # output cap for document extraction (legacy BEDROCK_MAX_TOKENS)
 # AI_PROVIDER=
+# Outbound email (invoices, reminders). Pick one provider. Resend is what
+# hosted runs; SMTP is for self-hosts that want mail on their own relay.
+# EMAIL_PROVIDER=resend|smtp   # optional; RESEND_API_KEY wins, else SMTP_HOST
+# RESEND_API_KEY=
+# RESEND_FROM_EMAIL=
+# SMTP_HOST=
+# SMTP_PORT=587
+# SMTP_SECURE=false            # true = implicit TLS on 465, false = STARTTLS required (set SMTP_REQUIRE_TLS=false only for a plaintext LAN relay)
+# SMTP_USER=
+# SMTP_PASS=
+# SMTP_FROM_EMAIL=
+# SMTP_REQUIRE_TLS=true        # false only for a plaintext relay on a trusted LAN
+# SMTP_TLS_REJECT_UNAUTHORIZED=true
 # Bank connections (Enable Banking)
 # ENABLE_BANKING_APP_ID=
 # ENABLE_BANKING_PRIVATE_KEY=