v1.5.0: harden verified email and private mediation context

[Alex0158]

Purpose

Single release candidate that supersedes PR #11 and combines two inseparable P0 trust boundaries: verified email delivery and owner-scoped private-context/Safety governance across Backend, Web, App, shared contracts, migrations, tests, and core docs.

No Production deployment is claimed here.

Included

• hashed one-time email challenges, proof-first registration, verified legacy-account recovery, canonical email safety, and sensitive-log redaction
• Production SMTP startup/readiness fail-closed behavior plus mandatory provider-acceptance canary
• owner-scoped private context, fresh participant revalidation, explicit adaptation consent, mediation claims, and usage receipts
• capsule lifecycle and discard semantics without exposing one participant private content to the other
• participant-scoped Safety Router state and shared-room pause visibility
• matching Web and App trust controls through shared contracts
• release-blocking migrations and updated core governance docs

Verification

• current exact-head local candidate: Backend full test run 208 of 210 suites / 2551 passing tests with 39 intentional skips; Backend lint/build remains covered by exact-head CI
• focused private-context and Safety coverage: 13 suites / 265 tests
• Web lint/build, 185 files / 2044 tests, critical E2E guard 6 files
• App typecheck, feature/platform contracts, 36 suites / 225 tests
• API client M3 11 tests; contracts and API client builds
• rollback contract 13 tests; email release contract 9 tests
• docs check and current dry-run audit
• fresh disposable PostgreSQL migrations, CITEXT compatibility, and production-like authenticated TLS SMTP true-service flow passed for the unchanged migration/email set
• GitHub exact-head CI: 7 of 7 jobs successful at d3f026a99bbd2a65e2b156096da36e9542034e5f

Production release gate status

The Railway Production SMTP variables and verified emorapy.com sender domain were configured on 2026-07-14 without triggering a deployment. Both Resend API keys later became active after a provider-side delay; the key already stored in Railway passed SMTP authentication and a provider canary with 1 accepted / 0 rejected, and Resend recorded the test messages as delivered.

This removes the external SMTP prerequisite only. Do not claim Production complete until the exact main SHA passes push CI, the formal Production Deploy and Verify workflow succeeds, and the deployed runtime email canary, version alignment, database gates, health/readiness, mutating smoke, and rollback evidence all pass.

Residual boundaries

Quick Session aggregate atomicity, durable Safety recovery workflows, full cross-case memory/data-rights governance, sustained cross-instance race evidence, and credential-backed live two-party/native-device evidence remain tracked P1 work. They are not treated as complete by this PR.

[Alex0158]

Retargeted to main so the repository CI policy can validate the consolidated exact head. Reopening immediately; this is not a release or readiness claim.

[Alex0158]

Exact-head CI completed successfully: 7 of 7 jobs passed for 2825e54 in run https://github.com/Alex0158/emorapy/actions/runs/29276316323. The PR remains Draft because the read-only Railway Production check confirmed the required SMTP, verified sender, OTP pepper, TLS, and canary configuration is still absent. This comment is not a Production deployment claim.