feat(mail): mails at registration, block and delete

readme.md

@@ -69,6 +69,10 @@ To Be Played is split into three repositories:
   and end time, type `DISMISS` or `ACCEPT`). The dashboard shows the running hints one at a time, newest first.
   "Do not show again" on a `DISMISS` hint or "OK" on an `ACCEPT` hint is a row in `hint_done`, so the hint never
   comes back for this user on any device. Creating and ending a hint are rows in `admin_audit`.
+- **Mails** from the platform mailbox: "new user registered" to the admin (`APP_MAIL_ADMIN_TO`), and to the user
+  "your account is active" at the registration, "your account is blocked" and "your account will be deleted from
+  <date>". The registration sends the browser language (`de` for a German browser, else `en`), which also becomes
+  the user's app language. Plain text only. See "Mail flow".
 - **Delete my account** with the password (5 wrong tries per 15 minutes, then `429`). It only sets
   `users.deleted_at` and revokes every refresh token: from then on no login, no refresh, no access token, no public
   profile, no Steam link, not in the landing stats. Email and display name stay taken; the Steam ID is freed, so an
@@ -223,7 +227,7 @@ sequenceDiagram
     participant A as Auth
     participant C as Core
     B->>A: DELETE /api/users/me {password}
-    A->>A: users.deleted_at = now, revoke refresh tokens
+    A->>A: users.deleted_at = now, revoke refresh tokens, mail row (one transaction)
     A->>C: POST /internal/accounts/deleted (service token)
     A-->>B: 204, both cookies cleared
     Note over A: an old access token gets 401 within 30 s (activeUsers cache)
@@ -238,6 +242,26 @@ sequenceDiagram
 A failed call to Core does not fail the delete: the next night sends the whole flagged set again. Undo within 30
 days is `UPDATE users SET deleted_at = NULL` (see the Deployment README).
 
+### Mail flow
+
+Each mail is a row in `mail_outbox`, written in the transaction of its event, so the event never fails because of
+the mail server and no mail is lost when Auth restarts. The text is rendered then, in the user's language (`de`,
+else English); the admin mail is German.
+
+```mermaid
+sequenceDiagram
+    participant B as Browser (Frontend)
+    participant A as Auth
+    participant M as SMTP (Hostinger)
+    B->>A: register / admin blocks / delete account
+    A->>A: event + mail_outbox row (PENDING), one transaction
+    loop every minute (MailOutboxService)
+        A->>M: up to 20 due rows
+        M-->>A: ok: SENT / error: try again after 1, 2, 4 ... 60 min
+    end
+    Note over A: after 10 tries FAILED and a warning in the log; SENT rows are removed after 30 days
+```
+
 ### Steam ID and block sync to Core
 
 Core keeps its own copy of the Steam ID and of the block. After a verified Steam link (also for the account that