SES: remove SendGrid path and revoke the shared API key

[mroderick]

Depends on the cutover-confirmation issue, and is coordinated with planner's SendGrid teardown.

• Remove the SendGrid code path from src/auth.js (SES becomes the only transport; MAIL_TRANSPORT selection collapses with it)
• Remove the SENDGRID_API_KEY config var from the auth app
• Before revoking the key in SendGrid, check whether it comes from a Heroku SendGrid add-on or a standalone SendGrid account — that decides how it is revoked
• Revoke the key only after planner confirms its SES cutover (SES: confirm cutover complete planner#2930) and in step with planner's add-on cancellation (Cancel the SendGrid add-ons once SES is stable planner#2933) — the key is believed to be shared with the planner apps, where it is the SendGrid rollback credential until that cutover is confirmed

End state: auth sends via SES only, no SendGrid dependency in code or config, and the shared standing credential is gone.