feat(notificaciones): one send log across servicios and pólizas

Renewal avisos left behind only a `RenewalNotice` row, whose sole job is
gating: a row with `sentAt` drops the policy off the pending list. It
cannot represent a failed send or a customer with no address, so the
Pólizas tab had no "Registro de envíos" to show and a sent notice simply
vanished from the list.

Renewals now write `email_notification_log` — the same table the four
bulk jobs write — as `RENEWAL_NOTICE` / `POLICIES`, with rows for
failures and no-email skips too. `RenewalNotice` keeps its gating role
unchanged; the two are complementary, not redundant.

- extend `EmailNotificationType` (+RENEWAL_NOTICE) and
  `EmailNotificationServicio` (+POLICIES); `level` now carries the aviso
  generation on renewal rows, so every reader must branch on the type
  first (`notificationLevelLabel()` is the one place that lives)
- backfill emailed notices (`channel = 'EMAIL'`) into the log; MAIL-channel
  rows are legacy printed letters and are deliberately left out
- extract `NotificationLogService`/`NotificationLogModule` as the single
  writer, so a feature that sends mail records it without pulling the
  bulk-job pipelines into its module
- `GET /notifications/log` and `/stats` take a comma-separated `servicio`
  list; each tab reads its own slice. This also fixes the "Omitidos"
  view, which mapped to no filter at all and showed every row
- share one `NotificationLogPanel` between both tabs
- pass SES_* / NOTIFICATION_ADMIN_EMAILS through the galactus compose,
  which was missing them entirely — mail is runtime config, not a CI
  secret, and the prod image sets NODE_ENV=production so a blank config
  fails loudly instead of falling back to stdout

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/galactus/jorgecuadros-app.compose.yml

@@ -73,6 +73,22 @@ services:
       S3_BUCKET: ${S3_BUCKET:-jorgecuadros-documents}
       MINIO_ROOT_USER: ${MINIO_ROOT_USER:?MINIO_ROOT_USER must be set}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD must be set}
+      # Outbound mail (SES). Runtime config, never baked into the image and
+      # never a CI secret — the build does not send mail, this container does.
+      # The image sets NODE_ENV=production, which disables MailService's
+      # stdout dev fallback: leave these blank and every notification and
+      # renewal aviso fails with "El envío de correo no está configurado."
+      # rather than silently going nowhere. Values live in this stack's env
+      # file on galactus (deploy/.env.prod), same as DATABASE_URL.
+      SES_REGION: ${SES_REGION:-}
+      SES_FROM: ${SES_FROM:-}
+      SES_FROM_NAME: ${SES_FROM_NAME:-}
+      SES_ACCESS_KEY: ${SES_ACCESS_KEY:-}
+      SES_SECRET_KEY: ${SES_SECRET_KEY:-}
+      SES_CONFIGURATION_SET: ${SES_CONFIGURATION_SET:-}
+      # Who gets the per-job summary mail. Falls back to the two hardcoded
+      # defaults in NotificationsService when unset.
+      NOTIFICATION_ADMIN_EMAILS: ${NOTIFICATION_ADMIN_EMAILS:-}
     ports:
       - "${API_PORT:-3001}:3001"
     volumes:

deploy/jorgecuadros-app.env.example

@@ -33,8 +33,25 @@ S3_BUCKET=jorgecuadros-documents
 MINIO_ROOT_USER=jc_minio
 MINIO_ROOT_PASSWORD=CHANGE_ME
 
-SES_REGION=
-SES_FROM=
+# --- Outbound mail (Amazon SES) ----------------------------------------------
+# Belongs HERE, in the stack's env file on the host — not in Gitea Actions
+# secrets. The build never sends mail; the running container does, and it reads
+# these at boot (apps/api/src/mail/mail.service.ts).
+#
+# The production image sets NODE_ENV=production, which turns OFF the stdout dev
+# fallback. Leaving these blank does not silently swallow mail — every send
+# fails with "El envío de correo no está configurado.", and the failure is
+# recorded in the notification log. Fill them in before enabling any envío.
+#
+# SES_FROM must be a verified SES sending identity.
+SES_REGION=us-west-2
+SES_FROM=mail@jorgecuadros.com
+SES_FROM_NAME=Information Server
 SES_ACCESS_KEY=
 SES_SECRET_KEY=
+# Optional — only needed to publish bounce/complaint events.
 SES_CONFIGURATION_SET=
+
+# Recipients of the per-job summary email. Comma-separated; unset falls back to
+# the defaults in NotificationsService.
+NOTIFICATION_ADMIN_EMAILS=rmancinas@freakma.net,mpulido@freakma.net

deploy/jorgecuadros-app.stack.yml

@@ -55,11 +55,14 @@ services:
       S3_BUCKET: ${S3_BUCKET:-jorgecuadros-documents}
       MINIO_ROOT_USER: ${MINIO_ROOT_USER:?MINIO_ROOT_USER must be set}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD must be set}
+      # Outbound mail (SES) — runtime config, not a build-time CI secret.
       SES_REGION: ${SES_REGION:-}
       SES_FROM: ${SES_FROM:-}
+      SES_FROM_NAME: ${SES_FROM_NAME:-}
       SES_ACCESS_KEY: ${SES_ACCESS_KEY:-}
       SES_SECRET_KEY: ${SES_SECRET_KEY:-}
       SES_CONFIGURATION_SET: ${SES_CONFIGURATION_SET:-}
+      NOTIFICATION_ADMIN_EMAILS: ${NOTIFICATION_ADMIN_EMAILS:-}
     ports:
       - target: 3001
         published: ${API_PORT:-3001}