feat(invoices): per-recipient email delivery outcomes (#1384)

* feat(invoices): per-recipient email delivery outcomes

Resend delivery webhooks identify affected addresses in data.to, so one
message with CC recipients can carry independent To/CC outcomes instead
of masking the failing address into the aggregate reason text.

- new apply_invoice_delivery_provider_event RPC merges each reported
  recipient onto its immutable To/CC position with the same rank and
  timestamp ordering as the aggregate status (retry and out-of-order safe)
- recipient map is PII-free: keyed to:N / cc:N, BCC and unmatched
  recipients are never represented, and the map is cleared on PII redaction
- delivery summaries, API route and MCP tool expose the sanitized map;
  the route re-sanitizes as defense in depth
- UI shows a per-recipient status list under the aggregate outcome

The prod ops check in issue #1350 (webhook registered in Resend and
RESEND_DELIVERY_WEBHOOK_SECRET set in Vercel) cannot be verified from the
repo and remains a follow-up.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(invoices): commit provider event before cross-context read

The BCC-leak test applied the event inside the rollback-scoped service
role helper and then asserted through a separate member context, so the
applied status was rolled back before the read. Use the committing
runAsServiceRole helper for the apply, matching how the summary read is
performed in its own context.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

messages/en.json

@@ -3306,7 +3306,10 @@
     "delivery_status_explanation_suppressed": "The email provider has blocked this address after an earlier bounce or spam complaint, so the message was never sent.",
     "delivery_status_whole_send_note": "This applies to the whole send, not to individual recipients.",
     "delivery_provider_status_label": "Delivery status",
-    "delivery_provider_reason_label": "Reason from the recipient"
+    "delivery_provider_reason_label": "Reason from the recipient",
+    "delivery_recipient_statuses_label": "Status per recipient",
+    "delivery_recipient_statuses_summary": "The overall status shows the most serious reported outcome. Each recipient's result is shown below.",
+    "delivery_recipient_status_unknown": "No delivery report yet"
   },
   "invoice_credit": {
     "back": "Back",

messages/sv.json

@@ -3306,7 +3306,10 @@
     "delivery_status_explanation_suppressed": "Adressen är spärrad hos e-posttjänsten efter tidigare studs eller spam-anmälan, så mailet skickades aldrig.",
     "delivery_status_whole_send_note": "Beskedet gäller hela utskicket, inte enskilda mottagare.",
     "delivery_provider_status_label": "Leveransstatus",
-    "delivery_provider_reason_label": "Besked från mottagaren"
+    "delivery_provider_reason_label": "Besked från mottagaren",
+    "delivery_recipient_statuses_label": "Status per mottagare",
+    "delivery_recipient_statuses_summary": "Den övergripande statusen visar det allvarligaste beskedet. Resultatet för varje mottagare visas nedan.",
+    "delivery_recipient_status_unknown": "Inget leveransbesked ännu"
   },
   "invoice_credit": {
     "back": "Tillbaka",