[baba-dev]

Summary

• adds a first-class @aiwa/mail subsystem
• uses durable MariaDB outbox rows with BullMQ worker dispatch
• enforces separate sender identities:
  • security@aiwamediagroup.com for security, billing, and membership events
  • creator-tool@aiwamediagroup.com for routine activity notifications
• replaces auth verification webhook delivery with durable queued mail
• sends team-member-added and billing confirmation/rejection/reversal security mail
• adds SMTP failure classification, bounded retries, idempotency keys, and post-send redaction of sensitive bodies
• adds Prisma migration, environment validation, and mail package tests

Reliability model

Business/auth actions persist mail before delivery. Redis and SMTP are dispatch mechanisms rather than the source of truth, so transient outages do not lose queued mail.

Deployment

Configure the SMTP variables documented in .env.example, apply migrations, then restart web and worker services.

Follow-up within this PR

CI findings will be fixed before merge; routine generation/report event wiring can be expanded on top of the included routine-mail API without changing the transport architecture.