feat(renovaciones): renewal notification emails over SES

INSURANCE_FEATURES_SPEC §1. The office printed and mailed renewal letters
from the legacy CONTROL <ramo> RENEW[2/3] paper log; 91% of policyholders
have an email on file, so send the notice instead and keep the paper log
as the fallback.

A daily cron (06:00 America/Tijuana) sweeps three generations off
policyTo — 30 and 15 days before expiry, 7 days after — sends each
through SES, and upserts RenewalNotice by [policyId, generation] so a
policy is never notified twice for the same milestone. RenewalNotice now
records providerMessageId, so a later bounce or complaint webhook can be
traced back to the row that sent it.

- customers.emailOptOut excludes a customer from every sweep; editable
  from the customer form
- scheduled_job_states holds the sweep's lock and last successful run;
  the window is widened to cover days the job did not run, so a weekend
  outage does not silently drop a generation
- SES unconfigured is not an error outside production — messages are
  logged and skipped, so dev and CI never send
- /renovaciones (renewal:send, MANAGER+) lists what is pending per
  generation, runs the sweep by hand, and marks a notice sent by mail
  for the customers with no email
- POST /policies/:id/renewal-notices records that manual mark
- the aviso-renovacion report and the emails now share one projection
  (reports/renewal-letter.ts) instead of two copies of the mapping

apps/web/src/lib/api.ts

@@ -108,7 +108,7 @@ export class ApiError extends Error {
   }
 }
 
-async function apiFetch<T>(
+export async function apiFetch<T>(
   path: string,
   init?: RequestInit,
 ): Promise<T> {

apps/web/src/lib/types.ts

@@ -14,6 +14,7 @@ export type Ability =
   | "policy:delete"
   | "policy:ingest"
   | "policy:ocr-review"
+  | "renewal:send"
   | "property:create"
   | "property:update"
   | "property:delete"
@@ -963,6 +964,7 @@ export interface CustomerDetail {
   mobile: string | null;
   fax: string | null;
   email: string | null;
+  emailOptOut: boolean;
   notes: string | null;
   identificationType: string | null;
   identificationNumber: string | null;
@@ -993,6 +995,7 @@ export interface CustomerInput {
   mobile?: string;
   fax?: string;
   email?: string;
+  emailOptOut?: boolean;
   notes?: string;
   identificationType?: string;
   identificationNumber?: string;