Provide the business site's dedicated Email sender #5400

🤖 Generated by the Agentic Engineer

Summary

Provide a dedicated automated sender for the business site using the company Email service.

User Story

As the business owner, I want automated company email from the business site so that I and clients receive the messages needed for our workflows.

Motivation

The maintainer requested automated messages to the owner or clients, including future password resets and announcements. Reusing the agents' restricted identity would mix application access with private operational correspondence.

Proposed Solution

Declare the sender and its enforced sending identity, separate scoped application credentials, private custody and delivery controls. Keep exact production addresses in private operator configuration. Preserve credentials on replay and restore; do not weaken the agents' recipient restriction.

Acceptance Criteria

• The dedicated sender and credential custody can be recreated declaratively without overwriting restored credentials or creating a normal administrator mailbox.
• Authenticated submission permits only the configured sending identity; anonymous relay and a different envelope/header sender are refused.
• The business site's own server-side credential can send to authorized owner/client recipients with verified TLS, SPF, DKIM and DMARC.
• Rate limits, bounded retry/failure reporting and revocation are exercised with synthetic inputs; no credentials or message contents enter public logs.
• Runtime configuration and rollback are documented; protected merge and actual delivery readback complete the slice.

Dependencies

Part of #5030. Credential activation follows verified backup recovery and the Email identity/recovery work in #5376 and #5387. The website integration is a separate sibling delivery; undeployed identity, password-reset or announcement features remain disabled until their own acceptance passes.

Priority High, effort Medium, Standard.