fix: move Railway email delivery to Resend HTTPS API

[Alex0158]

Outcome

• switch Railway Production email delivery from blocked outbound SMTP to Resend HTTPS API
• retain SMTP as an explicit non-Production-compatible adapter, with no fallback from API mode
• migrate and rollback EMAIL_DELIVERY_MODE safely inside the formal workflow
• update release gates, runbooks, environment validation, and incident evidence

Root cause

Production run 29373051702 built the backend image successfully, but Railway returned SMTP TIMEOUT during startup until /health/ready failed. Railway disables outbound SMTP on Free/Trial/Hobby and recommends transactional HTTPS APIs. The workflow rolled back successfully and never deployed Vercel.

Verification

• backend full Jest: 209 suites passed, 2556 tests passed; 2 suites / 39 tests intentionally skipped
• focused email/config/API transport: 37 tests passed
• backend build and lint passed
• rollback contract: 13/13 passed
• email release contract: 9/9 passed
• docs:audit:dry-run:current, docs:check, Node syntax, and git diff --check passed

Production migration

Before the next formal release, Railway receives a sealed RESEND_API_KEY copied from the already-validated Resend sending key while the current runtime remains on SMTP mode. The workflow captures the previous mode, switches to resend_api with --skip-deploys, and restores the captured mode before a rollback deployment if any later gate fails.