Use Sendico SMTP mailbox for local notifications (#57)

docs/signup-facts.md

@@ -94,6 +94,39 @@ gRPC failure response. No security scan or real customer email retry was run.
 
 ## Behavior and boundaries
 
+### Local mail client
+
+The user subsequently selected Sendico's existing mailbox instead of Resend for
+local notifications. The authoritative Sendico configuration resolves to
+`no-reply@sendico.io`, `mail.sendico.io:465`, authenticated implicit TLS and a
+10-second network timeout. SXCHNGE's owned `smtp` adapter consumes rendered email
+models through the existing sender contract and queue; it does not import or
+access Sendico business modules, databases or messaging. The password was copied
+once, without printing it, from the running Sendico notification environment into
+`services/notifications/email/smtp` in SXCHNGE Vault. Only `password` is stored
+there; host, port, username, display name and sender remain in runtime YAML.
+
+The SMTP adapter verifies certificates, authenticates before submission, sends
+UTF-8 MIME alternatives, and requires the final DATA 250 reply for acceptance.
+SMTP 4xx replies retry through the existing worker policy; 5xx replies fail;
+ambiguous transport outcomes remain UNKNOWN and are not immediately resent.
+Message-ID is correlation only, not a provider idempotency guarantee. Existing
+failed Resend notifications are not replayed or rewritten. The unverified
+`sxchnge.com` Resend domain is no longer the selected local delivery path.
+
+Live verified-TLS SMTP authentication and NOOP succeeded with reply 250, without
+submitting email. SMTP adapter race tests and backend lint pass. Local tooling
+fixtures pass, including password-only Vault validation. Broader validation is
+currently blocked by Docker: the service integration test timed out starting its
+Testcontainers reaper; both `GOFLAGS=-p=2 make test` and its `-p=1` retry fail in
+the existing credential-rotation setup while copying files into a disposable
+MongoDB container (90-second context timeout). No checks were disabled. Fresh
+stable image pins resolved on retry; two image builds hit a Go proxy TLS
+handshake timeout during protobuf generator installation. The generator stage
+now shares the existing BuildKit Go module/build caches, preserving its pinned
+tool versions and generation command; the image rebuild is in progress.
+
+
 With `api.sendico` configured, the product BFF creates the local pending customer
 and activation token atomically, then registers an independent individual through
 Sendico's public HTTP API and submits the sign-up assertions. It persists the