Outbound-mail transport for the control plane's email-verification magic-link ceremony (issue #962).
The control plane holds no mail-provider credential of its own. Sending a
verification link is delegated to this deployment's web Worker
(apps/web), which owns a native outbound-mail send capability behind
its own binding — a much smaller credential footprint in the cluster than
a full mail-provider account token. [EmailRelayClient] dials the
Worker's EmailRelayService over Connect RPC — the mirror image of every
other control-plane/Worker service in this repo (there, the control plane
is the server; here, it is the client and the Worker is the callee).
This crate never talks to a mail provider directly, and depends on
nothing but the shared wire types (polyc-proto).
[OutboundMail] is deliberately a trait, not [EmailRelayClient] itself,
so a caller (the control plane's email_link module) can test against an
in-memory double instead of a live Connect client.