SES: dual-path email transport (SendGrid default, SES via config)

[mroderick]

The only code change the migration needs.

• Add an SES v2 send path beside the existing SendGrid fetch in src/auth.js, selected by a MAIL_TRANSPORT config var that defaults to sendgrid — behaviour is unchanged until the var is set
• SES sender uses @aws-sdk/client-sesv2; build the SendEmail command in a separate, unit-testable builder mirroring how buildMagicLinkPayload isolates the SendGrid request shape
• Unit tests for the SES command builder and the transport selection
• No changes to magic-link content or expiry

Rollback after cutover is a config flip (MAIL_TRANSPORT=sendgrid, or unset the var) — not a deploy revert. This matters because there is no staging auth app: auth.codebar.io serves both the production and staging planners, so every magic-link send is sign-in-critical.

Depends on: none (independent of the IAM credentials issue — code can land and merge while credentials are being created).