Relay transactional email through Salesforce instead of SMTP

Our SMTP host's IP reputation gets its mail blocked by allowlist-based
receivers (t-online.de). Route voucher confirmations, account activation
and password-reset mail through the Salesforce org's MTA + DKIM instead,
via a new EmailSendResource Apex REST endpoint.

- common/salesforce.client.ts: shared client-credentials access (token
  cache + retry-once-on-401), extracted from the newsletter sync so it is
  no longer duplicated
- common.mail.nodemailer.ts -> common.mail.ts: posts to the org endpoint,
  never throws on a delivery failure (logs + returns a boolean), retries
  once on a transient failure, base64-encodes attachments with a 3 MB cap
- drop the nodemailer dependency
- fixes activation/reset email failures that previously threw after the
  transaction had already committed
- tickets.confirmation-email.ts: shared confirmation-email builder used by
  both the public redeem path and a new admin resend action
- redemptions gain a confirmation_email_status column (migration 003) so
  the admin UI can flag a failed send; POST
  /tickets/admin/redemptions/:id/resend-confirmation rebuilds and resends

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/models/tickets/public/voucher.public.service.ts

@@ -1,20 +1,11 @@
 import * as EventsService from '../../calendar/events/events.service';
-import * as IcalService from '../../calendar/events/icalgenerator.service';
-import {MailService} from '../../../common/common.mail.nodemailer';
 import logger from '../../../middleware/logger';
 import {NachklangTicketsDB} from '../Tickets.db';
 import {getEventTicketState} from '../tickets.capacity';
+import {recordConfirmationEmailResult, sendRedemptionConfirmation} from '../tickets.confirmation-email';
 import {EligibleEvent, RedeemRequest, VoucherValidation} from '../tickets.interface';
 import {isValidEmail} from '../tickets.validation';
 
-const formatGermanDateTime = (date: Date): string => {
-	return new Intl.DateTimeFormat('de-DE', {
-		dateStyle: 'full',
-		timeStyle: 'short',
-		timeZone: 'Europe/Berlin'
-	}).format(date);
-};
-
 /**
  * Builds the eligible-events list for a code: for each event it's linked
  * to, merges live Calendar event details with the Tickets module's own
@@ -173,43 +164,21 @@ export const redeemVoucher = async (code: string, request: RedeemRequest): Promi
 	}
 
 	// Sent after commit, mirroring the Calendar/Feedback convention: a mail
-	// delivery failure shouldn't roll back a successful redemption. Caught
-	// rather than left to propagate - the redemption already succeeded, so
-	// a mail-server hiccup must not turn into a false failure response to
-	// a guest who has, in fact, already secured their spot.
+	// delivery failure shouldn't roll back a successful redemption, and the
+	// guest has in fact already secured their spot. The send itself no longer
+	// throws on a delivery problem; its result is recorded on the redemption
+	// so staff can spot and resend a failed confirmation from the admin UI.
 	try {
-		await sendConfirmationEmail(eventId, request, redemptionId);
+		const sent = await sendRedemptionConfirmation({
+			eventId,
+			contactName: request.contactName,
+			contactEmail: request.contactEmail,
+			guestNames: request.guests.map(g => g.name)
+		});
+		await recordConfirmationEmailResult(redemptionId, sent);
 	} catch (e: any) {
-		logger.error('Redemption ' + redemptionId + ' succeeded but confirmation email failed to send: ' + e.message);
+		logger.error('Redemption ' + redemptionId + ' committed but the confirmation email step failed: ' + e.message);
 	}
 
 	return {status: 'OK', redemptionId};
 };
-
-const sendConfirmationEmail = async (eventId: number, request: RedeemRequest, redemptionId: number): Promise<void> => {
-	const event = await EventsService.getEventById(eventId);
-	if (!event) return;
-
-	const guestList = request.guests.map(g => `- ${g.name}`).join('\n');
-	const body = `Hallo ${request.contactName},\n\n` +
-		`vielen Dank für deine Anmeldung zu "${event.name}"!\n\n` +
-		`Termin: ${formatGermanDateTime(event.startDateTime)}\n` +
-		`Ort: ${event.location}\n\n` +
-		`Angemeldete Gäste:\n${guestList}\n\n` +
-		`Wir freuen uns auf dich!\n\nDein Nachklang-Team`;
-
-	let icsAttachment;
-	try {
-		const ics = await IcalService.convertToIcal([event]);
-		icsAttachment = [{filename: 'konzert.ics', content: ics, contentType: 'text/calendar'}];
-	} catch {
-		icsAttachment = undefined;
-	}
-
-	await MailService.sendMail(
-		request.contactEmail,
-		`Bestätigung: ${event.name}`,
-		body,
-		{attachments: icsAttachment}
-	);
-};