Keep email runtime configuration out of Vault

infra/local/scripts/bootstrap.sh

@@ -98,20 +98,19 @@ up() {
    random | jq -Rs --arg field "$field" '{($field):rtrimstr("\n")}' | put "$path"
   fi
  done
- printf '{"driver":"resend","api_key":"","sender_address":"notifications@localhost.test","sender_name":"SXCHNGE local"}' | ensure services/notifications/email/resend
+ printf '{"api_key":""}' | ensure services/notifications/email/resend
  provision_mongo
  provision_agents
  compose up -d --wait --wait-timeout 120 nats
  retire_secrets
- kv services/notifications/email/resend | email_valid || fail 'Vault kv/services/notifications/email/resend needs a Resend api_key and verified sender_address. Run make email, then make up.'
+ normalize_email_secret
+ kv services/notifications/email/resend | email_valid || fail 'Vault kv/services/notifications/email/resend needs api_key. Run make email; configure the verified sender in infra/local/notifications/runtime.yml, then make build && make up.'
  compose up -d --wait --wait-timeout 180
  export_ca
  echo 'Local stack ready: https://localhost:5126; Vault: http://127.0.0.1:18200'
 }
 email() {
  existing
- printf 'Verified Resend sender address: ' >&2
- IFS= read -r address
  printf 'Resend API key (hidden): ' >&2
  tty_state=$(stty -g)
  trap 'stty "$tty_state"; cleanup' EXIT
@@ -120,9 +119,8 @@ email() {
  stty "$tty_state"
  printf '\n' >&2
  [ -n "$key" ] || fail 'A key is required'
- case "$address" in *@*) ;; *) fail 'A sender email address is required';; esac
  printf '%s' "$key" > "$WORK/email-key"
- printf '%s' "$address" > "$WORK/email-address"
- jq -n --rawfile key "$WORK/email-key" --rawfile address "$WORK/email-address" '{driver:"resend",api_key:$key,sender_address:$address,sender_name:"SXCHNGE"}' | put services/notifications/email/resend
- echo 'Email configuration saved in Vault. Run make up.'
+ normalize_email_secret
+ jq -n --rawfile key "$WORK/email-key" '{api_key:$key}' | put services/notifications/email/resend
+ echo 'API key saved in Vault. Set the verified sender in infra/local/notifications/runtime.yml, then make build && make up.'
 }