Door delivery: outbox drainer + SMTP transport (inert until configured)

The §15 door's email_send queues to `outbox` but nothing delivered it. Add a
real transport: cm-db outbox repo (list_queued/mark_sent/mark_failed) + a
cm-runtime drainer — an EmailSender trait (testable), a lettre STARTTLS
LettreSender, drain_once (queued -> sent/failed), and spawn_drainer wired into
the server beside the scheduler/sweeper/topology-worker.

Config-gated: inert (logs "outbox delivery DISABLED") until CLAWMATES_SMTP_*
is set, so it ships safely before credentials exist. The agent never holds the
SMTP credential — it only writes to outbox through the gated door; the server
owns the transport.

NOTE: live delivery is still credential-blocked — Migadu's API can't send
(SMTP-only) and the admin token is invalid; no SMTP creds exist. The transport
is built + tested (drain_marks_sent_and_failed via a mock sender); set
CLAWMATES_SMTP_* to go live with zero further code. clippy clean.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

crates/cm-db/src/repo/outbox.rs

@@ -0,0 +1,52 @@
+//! The outbound-email queue. The gated `email.send` tool enqueues rows here
+//! (after §15 policy); the delivery drainer (cm-runtime) sends them over SMTP
+//! and flips their status.
+
+use sqlx::PgPool;
+use uuid::Uuid;
+
+use crate::DbError;
+
+/// A queued outbound email awaiting delivery.
+pub struct QueuedEmail {
+    pub id: Uuid,
+    pub recipient: String,
+    pub subject: String,
+    pub body: String,
+}
+
+/// The oldest `queued` emails, up to `limit` (FIFO by enqueue time).
+pub async fn list_queued(pool: &PgPool, limit: i64) -> Result<Vec<QueuedEmail>, DbError> {
+    let rows = sqlx::query!(
+        "SELECT id, recipient, subject, body FROM outbox
+         WHERE status = 'queued' ORDER BY created_at LIMIT $1",
+        limit,
+    )
+    .fetch_all(pool)
+    .await?;
+    Ok(rows
+        .into_iter()
+        .map(|r| QueuedEmail {
+            id: r.id,
+            recipient: r.recipient,
+            subject: r.subject,
+            body: r.body,
+        })
+        .collect())
+}
+
+/// Mark a queued email delivered.
+pub async fn mark_sent(pool: &PgPool, id: Uuid) -> Result<(), DbError> {
+    sqlx::query!("UPDATE outbox SET status = 'sent' WHERE id = $1", id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+/// Mark a queued email failed (delivery error; left for inspection, not retried).
+pub async fn mark_failed(pool: &PgPool, id: Uuid) -> Result<(), DbError> {
+    sqlx::query!("UPDATE outbox SET status = 'failed' WHERE id = $1", id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}