Implement Phase 2 webhook delivery truth and suppression

[ttenneb]

Summary

Implements the default-off Phase 2 Resend webhook and suppression rollout on top of #35.

• adds a signed raw-body webhook inbox with deduplication, bounded payload retention, replay, purge, reconciliation, dead letters, and a dedicated fenced projector
• projects provider delivery outcomes without conflating provider acceptance and confirmed delivery
• adds reason-keyed provider-account suppression with deterministic event ordering, audited overrides, launch readiness checks, and provider-boundary race fencing for survey, account, demo, and canary mail
• adds delivery/canary correlation tags, six-hour canaries, EMF metrics, CloudWatch/SNS alarms, and dashboard delivery-outcome visibility
• adds independent default-off ingestion, projection, suppression, and global sending controls with release capability floors and rollback safeguards
• adds crash-recoverable disabled-first registration, overlapping-secret rotation, SSM handling, operator tooling, and rollout/runbook documentation

Rollout safety

All hosted Phase 2 gates remain off by default. Staging registration and activation are explicit operator steps. Production registration remains blocked until the shared Resend account is upgraded to support separate staging and production endpoints.

This is a stacked PR and should merge after #35.

Validation

• API: 80 tests passing
• Dashboard: 61 tests passing; production build passing
• Respondent app: 11 tests passing; production build passing
• Fresh and rerun Liquibase migrations passing
• Real PostgreSQL API lifecycle/provider-boundary smoke passing
• Real PostgreSQL webhook/suppression smoke passing
• Terraform root, staging, and production validation passing
• JavaScript, shell, workflow/YAML, formatting, and git diff --check validation passing
• fresh adversarial backend/security/concurrency and operations/infrastructure reviews: no remaining blockers or majors