feat: add scheduler and mail outbox

SMTP adapter with TLS and a fake, outbox with retries, backoff, rate limit and restart safety, scheduler tick with job-run records started by gunicorn, and a send_test_mail command.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

.env.example

@@ -40,6 +40,16 @@ OIDC_CLIENT_SECRET=
 # redirect address registered at the provider is this plus /auth/callback.
 PUBLIC_BASE_URL=https://portal.example.test
 
+# Required. The mail server and mailbox the portal sends e-mail through, always over TLS.
+# SMTP_SECURITY is starttls (default, port 587) or ssl (port 465); SMTP_PORT overrides the port.
+# MAIL_FROM is the sender address, optionally with a display name: Portal <portal@example.test>
+SMTP_HOST=
+# SMTP_PORT=587
+# SMTP_SECURITY=starttls
+SMTP_USERNAME=
+SMTP_PASSWORD=
+MAIL_FROM=
+
 # Optional. Directory for the database. Default /data (the container volume).
 # DATA_DIR=/data