feat(templates): T6 controller + DTOs + module wiring

POST /v1/templates/send (render→queue) and /preview (render only). OPA-gated in
the sender: iios.template.send, and iios.template.send.inline for ad-hoc HTML
(arbitrary markup to a customer is riskier than a reviewed stored template).
Scope resolved from the caller's principal. TemplateModule registered in AppModule.

Verified over HTTP against a local boot: preview + send of the seeded
payment.receipt (SENT via sandbox, provenance persisted), XSS name escaped,
idempotent replay → 1 row, unknown key 404, bad channel/no-source/no-auth 400.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/iios-service/src/templates/templated-sender.spec.ts

@@ -18,7 +18,7 @@ const asService = prisma as unknown as PrismaService;
 function sender(): TemplatedSender {
   const outbound = new OutboundService(asService, new CapabilityBroker(makeFakePorts(), new CapabilityProviderRegistry()), new IdempotencyService(asService));
   const templates = new TemplateService(new TemplateRepository(asService));
-  return new TemplatedSender(templates, outbound);
+  return new TemplatedSender(templates, outbound, makeFakePorts());
 }
 
 async function seedReceipt() {