feat(api): tenant-scoped sender and provider configuration

[patoperpetua]

Summary

• Add TENANT_EMAIL_CONFIG_BY_ID (App Configuration: app:email:tenantConfigById) to resolve per-tenant/environment fromAddress, fromDisplayName, and replyTo server-side, merged with platform EMAIL_FROM_* defaults.
• Wire send.ts to use resolved tenant sender identity; request-body sender/reply-to fields are ignored. Missing tenant config returns stable TENANT_CONFIG_NOT_FOUND.
• Support optional per-tenant providerAccount via TENANT_PROVIDER_ACCOUNT_SECRETS (Key Vault-backed env var references). Append troubleshooting row for the new error code.

Closes #35

Test plan

• pnpm -r --if-present run test passes
• Tenant sender fields applied from config (send.tenant-sender.spec.ts)
• Request-body sender spoofing has no effect
• Missing tenant config returns TENANT_CONFIG_NOT_FOUND without leaking another tenant's sender
• Platform defaults apply only for unset tenant fields
• Provider credentials not exposed in error responses or logs

Made with Cursor

[coderabbitai]

Warning

Review limit reached

Next included review available in 7 minutes.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 74bc64ad-a75b-4878-a0f7-52e3005b53d6

📥 Commits

Reviewing files that changed from the base of the PR and between a2dfa4e and c26c379.

📒 Files selected for processing (13)

• .env.example
• apps/api/src/config/app-configuration.ts
• apps/api/src/functions/send.security.spec.ts
• apps/api/src/functions/send.spec.ts
• apps/api/src/functions/send.tenant-sender.spec.ts
• apps/api/src/functions/send.ts
• apps/api/src/tenant/index.ts
• apps/api/src/tenant/tenant-email-config.spec.ts
• apps/api/src/tenant/tenant-email-config.ts
• docs/operations/troubleshooting.md
• packages/post-kit-email/src/providers/create-email-provider.ts
• packages/post-kit-types/src/index.spec.ts
• packages/post-kit-types/src/send.ts

---

_{Comment @coderabbitai help to get the list of available commands.}