feat(email): SMTP mailer behind the EmailService seam (EMAIL_PROVIDER=smtp); Resend stays the hosted default (#1746)

SmtpEmailService (nodemailer 9.0.5, exact-pinned) behind the existing EmailService seam. Provider resolution: EMAIL_PROVIDER wins, else RESEND_API_KEY selects Resend (hosted byte-identical), else SMTP_HOST selects SMTP. From header is built exactly like the Resend service after #1956 (no 'via <app>', fromAddress honored, platform-sender retry). STARTTLS is required by default (requireTLS) with SMTP_REQUIRE_TLS=false as an explicit opt-out for a plaintext LAN relay. Docs, env examples and the generated extension registry updated.

scripts/checks/no-new-antipatterns.mjs

@@ -686,6 +686,13 @@ const PINNED_DEPS = [
       'Paired with ai 6.x; the provider package follows its own major cadence and must move together with ' +
       'the core pin in one reviewed change.',
   },
+  {
+    name: 'nodemailer',
+    version: '9.0.5',
+    reason:
+      'SMTP mailer for self-hosts (extensions/general/email/lib/smtp-service.ts). Zero-dependency MIT-0 ' +
+      'package on the outbound-mail path; bumps are deliberate, reviewed PRs (audit surface), never silent.',
+  },
 ]
 
 const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')