Tracks only idempotency and delivery metadata; recipient, subject, and body are excluded. No provider send path is enabled.
- consolidate API ownership and remove dead vendor code - add Stripe billing, learning paths, and public CV hardening - add migration, recovery, security, audit, and browser gates