feat(mail): email attachments over SMTP

Email can now carry attachments (e.g. an invoice PDF). The kernel already stored
attachments as message parts + the media StoragePort holds the bytes; the gap was
the email envelope.

- EMAIL payload carries attachment REFS ({filename, contentRef, mimeType}), not
  bytes — the ledger + T8 PII redaction stay small; bytes are fetched at send time.
- SmtpProvider takes an AttachmentResolver; resolves each ref via storage and attaches
  (nodemailer). FAILS CLOSED if a declared attachment can't be resolved (or no resolver
  is wired) — never send a receipt/invoice missing its file; a FAILED command retries.
- CapabilityProviderRegistry injects the resolver from STORAGE_PORT (@Optional);
  MediaModule exports STORAGE_PORT, CapabilityModule imports MediaModule. No cycle.
- TemplatedSender + MailService + the /v1/mail/send DTO pass attachments through.

Verified: 6 new unit tests (attach, fail-closed x2, plain-unaffected, resolver,
pass-through) + a REAL Ethereal SMTP send WITH a PDF attachment (SENT). Full suite
294/294, boundary + build clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/iios-service/src/mail/mail.service.ts

@@ -33,6 +33,8 @@ export interface SendExternalInput {
   locale?: string;
   idempotencyKey: string;
   purpose?: string;
+  /** Attachment refs (bytes resolved at send time). */
+  attachments?: Array<{ filename?: string; contentRef: string; mimeType?: string }>;
   /** The registered recipient to mirror to; omit for a pre-registration send (email only, no mirror). */
   mirrorToUserId?: string;
 }
@@ -64,6 +66,7 @@ export class MailService {
     const command = await this.sender.sendTemplated({
       source: input.source, channel: 'EMAIL', target: input.target, vars: input.vars ?? {},
       ...(input.locale ? { locale: input.locale } : {}), idempotencyKey: input.idempotencyKey, ...(input.purpose ? { purpose: input.purpose } : {}),
+      ...(input.attachments && input.attachments.length > 0 ? { attachments: input.attachments } : {}),
     });
 
     // Mirror only for a registered recipient (timing rule: no inbox exists pre-registration).