Implement survey lifecycle and durable email delivery

[ttenneb]

Summary

Implements Phase 0 correctness hardening and the Phase 1 survey lifecycle/durable invitation-delivery MVP described in docs/plan/survey-lifecycle-email-delivery.md.

• adds draft/active/closed lifecycle, transactional launch/close/reopen/archive behavior, stable-ID tenant scoping, and lifecycle mutation gates
• replaces initial invitation fire-and-forget delivery with durable PostgreSQL launches, template snapshots, deliveries, and append-only attempts
• adds a fenced PM2 worker with SKIP LOCKED leasing, provider idempotency, bounded retries/uncertainty, provider-boundary cancellation fencing, global rate reservations, heartbeat, and claiming controls
• adds readiness validation, workload bounds, exact replay semantics, and truthful accepted/failed/uncertain/cancelled aggregates
• adds dashboard launch/readiness/progress/history UI and lifecycle/role-aware read-only behavior
• disables the legacy untracked reminder route for Phase 1
• adds additive Liquibase migration safety, deploy/rollback handoff, Terraform rollout controls, CI migration/concurrency coverage, and an operator runbook
• preserves the latest survey-copy, invitation-subject, real-respondent demo, and production-cutover changes from main

Safety and rollout

• SURVEY_DELIVERY_V2_ENABLED is exact-true and defaults off in hosted environments.
• LEGACY_START_ENABLED remains off in hosted environments.
• Provider calls remain outside launch transactions and are fenced at the provider boundary.
• Acceptance is not presented as confirmed delivery; provider webhooks remain Phase 2.
• Migration is additive and preserves existing survey/respondent/response data.

Validation

• API: 67 tests passed
• Dashboard: 55 tests passed; production build passed
• Respondent: 11 tests passed; production build passed
• Fresh Liquibase migration passed against PostgreSQL
• Real PostgreSQL launch/worker/rate/lease/provider-boundary smoke passed
• Terraform root, staging, and production validation passed
• JavaScript, shell, Terraform formatting, and diff checks passed

Deferred

• Phase 2 Resend webhooks, provider delivery truth, suppression, reconciliation, and alerts
• Phase 3 selected reminders and immutable manual retries