Outbound-mail transport for the control plane's email-verification magic-link ceremony (issue #962).
The control plane holds no mail-provider credential of its own. Sending a
verification link is delegated to this deployment's wallet Worker
(apps/wallet), which owns a native outbound-mail send capability behind
its own binding — a much smaller credential footprint in the cluster than
a full mail-provider account token. [RelayMailApi] is a bearer-authed
HTTP client for that Worker's internal send endpoint
(POST /internal/send-verification-email); this crate never talks to a
mail provider directly, and carries no other polychrome-internal
dependency.
[OutboundMail] is deliberately a trait, not [RelayMailApi] itself, so
a caller (the control plane's email_link module) can test against an
in-memory double instead of a live HTTP relay.