Keep email runtime configuration out of Vault

infra/local/scripts/verify.sh

@@ -50,6 +50,7 @@ product() {
  echo 'PASS: six healthy services, frontend and proxied BFF use verified TLS; no email sent'
 }
 layout() {
+ kv services/notifications/email/resend | jq -e 'keys==["api_key"]' >/dev/null || fail 'Non-secret email configuration remains in Vault'
  for old in bootstrap/mongo bff caller email nats tls frontend-tls notifications-tls; do
   [ "$(vault "kv/metadata/$old" GET yes)" = null ] || fail "Obsolete KV entry remains: $old"
  done