MAS-WP-0012 finished: one outbound path and one send cap

mas_modes.mailer.Mailer is the only outbound path (own SQLite + lock),
shared by the ticket service and both EmailMode roles. Over the cap mail
is held and reported (send-cap-reached, held); held mail is purged after
email-held-duration-max (7d) and not stored beyond emails-held-storage-max
(100MB). The ticket service's legacy outbox is imported once so the live
count carries over (checked on a copy of the live DB: 4 sent). Entrypoint
passes the cap and both limits.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5787@bnt-lap001
Assistant-Session: 5db26b82-138b-40cc-9856-4d5eb0f752fd

docs/reuse-surface.md

@@ -29,7 +29,8 @@ You then:
 - answer `case.assign` with your own case id; email adopts it as
   `TYPE=ID@domain`;
 - send replies with `mail.send` (`in_reply_to` a recorded message);
-  principle 10 can refuse them;
+  principle 10 can refuse them, and over the deployment's one send cap
+  they are held (`held: true`) instead of sent;
 - decide per case on `autonomous_send` and `transfers`: `block`, or a
   mode webhook with that mode's `peer`. The peer must be one the email
   operator has a key for;