feat(onboard): a welcome email per role

[goetchstone]

What and why

Onboarding had one welcome email for every role. A role can now pick one of several named welcome emails ("Default", "Contractor", "Intern", …), so a contractor and an employee get different messages.

• Store: onboarding.json holds welcomes: {name: {subject, body}}. An older file's single welcome becomes Default on load, unchanged. Default can be edited, never deleted.
• Roles: a role's welcome names one (blank = Default). set_role refuses a name that doesn't exist; delete_welcome refuses Default and any email a role still picks, naming the roles. A name differing only by case saves over the existing email.
• Preview and Run: the preview names the email ("Welcome email “Contractor” to …") and Run sends the one it held. Bulk rows now snapshot their role's email at preview too; before, a CSV run read the email at run time, so an edit between Preview and Run changed what was sent. The bulk preview lists the email by role.
• Safety nets: a role whose email vanished anyway (a hand-edited file) blocks the send at preview rather than sending Default in its place; at run, a missing email is a recorded failed send, never a crash.
• Screens: the Welcome email tab lists the emails with Edit/Delete beside an editor; the role editor gets a picker that follows a save out of band, and onboarding.js keeps a half-edited role's choice across that swap.

How it was verified

• .venv/bin/python -m pytest -q passes (1593 passed)
• make lint is clean (ruff + mypy)
• A screen changed: make a11y passes (axe 0) and docs/guide.md says what's new

New tests: the migration from a single welcome, a role's email sent and held across an edit (single and bulk), Default for a role without a choice, delete refusals, the case-insensitive save, a vanished email blocking the send, and a missing email recorded as a failed send. Clicked through in the mock preview at 1100×760: add "Contractor", give a role that email, add "Intern" mid-edit (the role kept "Contractor"), preview a hire. /code-review high: 6 of 8 fixed (a JS-only check verified by hand; the store's silent reset on a corrupt file predates this and is tracked separately). A security review found nothing.

If it builds or runs a gam command

• No new argv: the welcome email still goes through send_welcome_email → _run_write; only which subject/body it sends is chosen
• /onboard/welcome/delete is local store only, classified LOCAL_ONLY in tests/test_write_routes_guarded.py

Live status: Offline only. Sending the welcome email is confirmed live (2026-09-30); a role-specific one has not run live yet.

Nothing private

• No credentials, real domain names, real addresses, or captures from a real tenant

🤖 Generated with Claude Code