Door delivery: outbox drainer + SMTP transport (inert until configured)

The §15 door's email_send queues to `outbox` but nothing delivered it. Add a
real transport: cm-db outbox repo (list_queued/mark_sent/mark_failed) + a
cm-runtime drainer — an EmailSender trait (testable), a lettre STARTTLS
LettreSender, drain_once (queued -> sent/failed), and spawn_drainer wired into
the server beside the scheduler/sweeper/topology-worker.

Config-gated: inert (logs "outbox delivery DISABLED") until CLAWMATES_SMTP_*
is set, so it ships safely before credentials exist. The agent never holds the
SMTP credential — it only writes to outbox through the gated door; the server
owns the transport.

NOTE: live delivery is still credential-blocked — Migadu's API can't send
(SMTP-only) and the admin token is invalid; no SMTP creds exist. The transport
is built + tested (drain_marks_sent_and_failed via a mock sender); set
CLAWMATES_SMTP_* to go live with zero further code. clippy clean.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

crates/bins/clawmates-server/src/main.rs

@@ -200,6 +200,9 @@ async fn run() -> Result<(), String> {
     // resume stale ones after a crash. Long-horizon topologies run here, not in
     // the HTTP request.
     cm_api::topology_worker::spawn(pool.clone(), std::time::Duration::from_secs(3));
+    // Outbound-email delivery: drains the §15-gated `outbox` over SMTP. Inert
+    // until CLAWMATES_SMTP_* is set, so it ships safely before credentials exist.
+    cm_runtime::spawn_drainer(pool.clone(), std::time::Duration::from_secs(10));
 
     // Hosted identity (Clerk / OIDC): pin the issuer and load its JWKS.
     let auth_verifier = match config.auth.mode {