feat(notifications): P2b email transport seam (Resend via fetch)

lib/email/send.ts: single sendEmail() over Resend's HTTP API (no SDK
dependency). Returns a retryable flag so the dispatcher distinguishes
transient (429 / 5xx / network) from permanent (config / validation)
failures. Unset RESEND_API_KEY/EMAIL_FROM is a clean non-retryable no-op
so a fresh clone still runs. Idempotency-Key wired for retry-safe sends.
Env documented in .env.example. 6 tests (fetch mocked).

.env.example

@@ -35,6 +35,16 @@ NEXT_PUBLIC_OAUTH_GOOGLE=
 # Node env (optional, defaults to "development" locally)
 NODE_ENV=development
 
+# Transactional email (optional; required for dues-lifecycle notifications).
+# Resend HTTP API key (https://resend.com, starts with "re_"). Unset = the
+# notification outbox still fills but the dispatcher records each row as
+# failed with "transport not configured" instead of sending.
+RESEND_API_KEY=
+# From address for all platform email. Must be on a domain you have verified
+# in Resend (SPF + DKIM) for production delivery. Friendly name optional.
+# Example: HeatSync Labs <noreply@hackerspace.sh>
+EMAIL_FROM=
+
 # Docker build flag (only when building the standalone image)
 # Set to "1" in the Dockerfile so next.config.mjs emits standalone output.
 # DOCKER_BUILD=1