feat(notification): confirm-before-unsubscribe, opt-out surfacing, and implementor email branding

[cjimti]

Closes #1022, closes #1023.

Confirm-before-unsubscribe (scanner prefetch guard)

GET /portal/notifications/unsubscribe renders a confirmation page and performs no mutation: corporate mail security layers (Safe Links, Proofpoint, and similar) prefetch URLs in message bodies, and the token is a bearer credential, so a mutating GET let a recipient's own mail infrastructure silently opt them out. The opt-out now records only on POST: the confirmation page's single-button form submit, or the RFC 8058 one-click body (List-Unsubscribe=One-Click), which is unchanged and keeps its bare status codes. Invalid tokens keep their per-path handling, and the page CSP gains form-action 'self'.

Opt-out state surfacing

The admin SMTP test send deliberately bypasses preference gating, which previously made "receives test mail but never notifications" a troubleshooting mystery. A new GET /api/v1/admin/settings/smtp/recipient-status endpoint reports an address's opt-out state, and the settings page shows an informational notice next to the send action for an opted-out target. The send is never blocked.

The guest share landing page shows a notice when the share's recipient has opted out, with a "Resume notification emails" action posting to /portal/view/{token}/resubscribe. Opting back in mirrors the no-mutation-on-GET rule of the unsubscribe endpoint it reverses: rate limited alongside the other public share routes, a uniform response for every share state (no share-existence oracle), restores only the immediate-delivery default, and logs each successful flip. Since the one-time-link email is delivered only to the stored recipient address, the person holding that landing page URL is ordinarily the recipient themselves.

Implementor email branding: footer text and Reply-To

portal.about_text, portal.support_contact, and portal.reply_to join the YAML config beside terms_url and privacy_url. Branding and sending identity are implementor-owned: in fully managed deployments they are not editable from the admin settings page, which stays transport-only (host, port, credentials, TLS, From).

When set, the about/support block renders as a footer in both the HTML and plaintext parts of every mail type (notifications, one-time guest links, admin tests), giving first-contact recipients sender context and lifting short image-bearing messages out of the low-text band content filters penalize (SpamAssassin HTML_IMAGE_ONLY_*). An email support contact links as mailto:, an http(s) URL directly. reply_to is applied as the Reply-To header on every outgoing message, validated once at startup and dropped with a warning when invalid. With all three unset, rendered output and headers are byte-identical to prior behavior, pinned by template-seam tests.

pkg/admin decomposition

pkg/admin sat two lines under its TestPackageSizeBudget cap, so the SMTP settings surface moves to a new pkg/admin/settingsapi subpackage, with pkg/admin keeping a thin registration that injects the shared request helpers. The import ratchet records the two new edges (pkg/admin -> pkg/admin/settingsapi -> pkg/notification): this is the budget-sanctioned decomposition seam, not new cross-layer coupling, and the admin-is-a-leaf depguard rule now excludes pkg/admin's own tree so the leaf can compose its subpackages. One behavior alignment: a malformed PUT /api/v1/admin/settings/smtp body now returns 400 problem+json like every sibling admin handler instead of an empty 200.

Verification

make verify passes end to end (race tests, coverage and patch-coverage gates, lint, gosec, govulncheck, semgrep, CodeQL, GoReleaser dry-run). Every new function carries 85 to 100 percent coverage, the full UI suite (351 tests) and Playwright e2e pass, and swagger is regenerated. Docs updated: notifications, configuration, admin portal, portal user, threat model, and both llms files.

[codecov]

Codecov Report

❌ Patch coverage is 98.41270% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.34%. Comparing base (b6b75a3) to head (adc56b1).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/admin/settingsapi/settingsapi.go	96.10%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1025      +/-   ##
==========================================
+ Coverage   89.31%   89.34%   +0.03%     
==========================================
  Files         468      469       +1     
  Lines       51652    51789     +137     
==========================================
+ Hits        46132    46270     +138     
  Misses       3668     3668              
+ Partials     1852     1851       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.