Allow user-engine egress to email-connect; record T04 hand-back.

NetworkPolicy egress to email-connect:8080 for transactional invitation send;
NK-WP-0024 note points at EMAIL-WP-0004 failure evidence.

sso-mfa/k8s/user-engine/runtime.yaml

@@ -144,6 +144,13 @@ spec:
           podSelector:
             matchLabels: {app.kubernetes.io/name: flex-auth-user-engine}
       ports: [{protocol: TCP, port: 8080}]
+    # EMAIL-WP-0004 transactional invitation/verification send path.
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: email-connect}
+          podSelector:
+            matchLabels: {app.kubernetes.io/name: email-connect}
+      ports: [{protocol: TCP, port: 8080}]
     - to:
         - namespaceSelector:
             matchLabels: {kubernetes.io/metadata.name: kube-system}

workplans/NK-WP-0024-user-engine-portal-integration-expansion.md

@@ -113,3 +113,12 @@ event routing, and idempotency. Existing USER-WP-0021 coverage proves provider
 outage, recovery, invitation expiry/replay, dead-letter/replay, and
 cross-tenant denial. The deployed-path matrix remains pending on the three
 production endpoints above.
+
+2026-08-12 EMAIL-WP-0004-T04 hand-back: transactional invitation mail receiver
+is live on railiance01 at
+`http://email-connect.email-connect.svc.cluster.local:8080`. Failure contract
+and non-secret evidence (retryable vs permanent codes, duplicate/resend,
+suppression, evidence ceilings, redaction) are in
+`email-connect/docs/EMAIL-WP-0004-T04-failure-evidence.md`. user-engine must
+mount only `EMAIL_CONNECT_INGEST_TOKEN` (not SMTP). Provider acceptance and
+mailbox challenges are not authorization.