Use Sendico SMTP mailbox for local notifications (#57)

docs/local-development.md

@@ -30,7 +30,7 @@ NATS, notifications, BFF and Caddy serving the frontend.
 On first startup, bootstrap initializes/unseals persistent Vault, provisions
 AppRoles and secrets, initializes Mongo replica set `rs0`, configures Vault's Mongo
 plugin, and starts authenticated NATS JetStream. Product startup fails explicitly
-until Resend credentials exist. Infrastructure remains available for provisioning.
+until the SMTP mailbox password exists. Infrastructure remains available for provisioning.
 
 After all services pass their startup health checks and the public Caddy CA is
 exported, `make up` prints a Sendico-style completion message with the frontend,
@@ -56,7 +56,7 @@ kv/
 ├── services/
 │   ├── bff/jwt                         # jwt
 │   └── notifications/
-│       └── email/resend                # api_key only
+│       └── email/smtp                  # password only
 └── infrastructure/
     ├── nats/auth                       # token; read by NATS and notifications
     └── mongo/bootstrap                 # local administrator and replica-set bootstrap material
@@ -74,29 +74,35 @@ There are no frontend certificates, notification certificates or generic `tls`
 entries in KV. Browser certificates belong to Caddy; internal gRPC is plaintext
 on the trusted private Docker network without caller authentication.
 
-## Resend
+## Local SMTP mail
 
 Open [Vault](http://127.0.0.1:18200) and edit
-`kv/services/notifications/email/resend`:
+`kv/services/notifications/email/smtp`:
 
 | Field | Value |
 | --- | --- |
-| `api_key` | Your Resend API key |
+| `password` | Password for the configured SMTP mailbox |
 
 The driver and sender settings belong in `infra/local/notifications/runtime.yml`:
 
 ```yaml
 email:
-  driver: resend
+  driver: smtp
   settings:
-    api_key_env: EMAIL_API_KEY
-    sender_address: "your-verified-sender@example.com"
+    host: mail.sendico.io
+    port: 465
+    username: no-reply@sendico.io
+    password_env: SMTP_PASSWORD
+    network_timeout: 10
+    sender_address: no-reply@sendico.io
     sender_name: "SXCHNGE"
 ```
 
-Set your verified address in that file and rebuild. It is intentionally empty by
-default, so notifications cannot start with an unconfigured sender. Vault Agent
-injects only the API key; it does not generate email configuration.
+The local stack uses Sendico's existing `no-reply@sendico.io` mailbox with
+authenticated implicit TLS on port 465 and certificate verification enabled.
+Vault Agent injects only the password; host, username and sender are non-secret
+runtime settings. Credentials are provisioned into SXCHNGE's own Vault; the
+notification service does not read Sendico configuration or secrets at runtime.
 
 Local administrator login material is in private `.local/dev/admin/init.json`.
 Product containers cannot access it. Alternatively use the hidden terminal prompt:
@@ -106,12 +112,15 @@ make email
 make build && make up
 ```
 
-No placeholder key or delivery fallback is installed. Startup validates presence;
-it does not send an email or validate domain ownership with Resend. Updating the
-API key causes Agent to restart notifications. Driver/sender changes require an
-image rebuild. Existing API keys survive bootstrap. Migration removes legacy
-driver/sender fields from the current Vault secret with a version-checked write;
-the preceding version is preserved in Vault history and the private archive.
+No placeholder password or delivery fallback is installed. Startup validates
+configuration and secret presence; the SMTP connection is opened on demand.
+Updating the password causes Agent to restart notifications. Driver/sender
+changes require an image rebuild. Old Resend secrets remain in Vault history
+but are not used or readable by the notifications AppRole. HTTP providers remain
+available for other deployments; switching one requires matching Agent/policy
+and runtime configuration. SMTP has no provider idempotency guarantee: explicit
+4xx rejections retry, 5xx rejections fail, and ambiguous transport outcomes require
+operator reconciliation before another send.
 
 ## Browser HTTPS and internal connections