feat: route email notifications through mail capability

docs/EMAIL_DELIVERY.md

@@ -0,0 +1,24 @@
+# Email Notification Delivery
+
+In-app notifications are the canonical notification channel. They remain
+available when no email implementation is installed.
+
+Production email delivery is an optional integration with the
+`mail.notificationDelivery` capability:
+
+- Notifications owns recipient intent, notification preferences, content, and
+  notification status.
+- Mail owns server profiles, credentials, queue persistence, retry policy, and
+  transport outcomes.
+- An accepted handoff is recorded as `accepted`; it does not claim that the
+  remote SMTP server has delivered the message.
+- If Mail or a usable profile is unavailable, delivery is recorded as
+  `paused`. The notification is retained and can be retried after the
+  capability becomes available.
+- Transport failures are recorded as `failed` with an attempt record and do
+  not remove the in-app notification.
+- File-based EML delivery is development-only and must not be used as a
+  production fallback.
+
+The capability contract deliberately passes references to recipient, tenant,
+and profile context without exposing or duplicating Mail credentials.