Relay transactional email through Salesforce instead of SMTP

Our SMTP host's IP reputation gets its mail blocked by allowlist-based
receivers (t-online.de). Route voucher confirmations, account activation
and password-reset mail through the Salesforce org's MTA + DKIM instead,
via a new EmailSendResource Apex REST endpoint.

- common/salesforce.client.ts: shared client-credentials access (token
  cache + retry-once-on-401), extracted from the newsletter sync so it is
  no longer duplicated
- common.mail.nodemailer.ts -> common.mail.ts: posts to the org endpoint,
  never throws on a delivery failure (logs + returns a boolean), retries
  once on a transient failure, base64-encodes attachments with a 3 MB cap
- drop the nodemailer dependency
- fixes activation/reset email failures that previously threw after the
  transaction had already committed
- tickets.confirmation-email.ts: shared confirmation-email builder used by
  both the public redeem path and a new admin resend action
- redemptions gain a confirmation_email_status column (migration 003) so
  the admin UI can flag a failed send; POST
  /tickets/admin/redemptions/:id/resend-confirmation rebuilds and resends

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

package.json

@@ -22,7 +22,6 @@
 		"express": "^4.18.2",
 		"guid-typescript": "^1.0.9",
 		"mariadb": "^3.0.2",
-		"nodemailer": "^6.9.8",
 		"random-words": "^1.1.1",
 		"swagger-jsdoc": "^6.1.0",
 		"swagger-ui-express": "^4.3.0",
@@ -35,7 +34,6 @@
 		"@types/express": "^4.17.15",
 		"@types/jest": "^28.1.3",
 		"@types/node": "^18.11.17",
-		"@types/nodemailer": "^6.4.14",
 		"@types/random-words": "^1.1.2",
 		"@types/swagger-jsdoc": "^6.0.1",
 		"@types/swagger-ui-express": "^4.1.3",