feat(branding): wire per-port branding through every transactional email + auth shell (R2-H15)

Multi-tenant branding admin (/admin/branding) was saving 5 settings
that no code read — every port's emails shipped Port Nimara's logo
and color regardless. Now wired end-to-end:

New shared infrastructure:
- src/lib/email/shell.ts — renderShell() + brandingPrimaryColor()
  helpers; takes BrandingShell { logoUrl, primaryColor,
  emailHeaderHtml, emailFooterHtml }, falls back to Port Nimara
  defaults when null.
- src/lib/email/branding-resolver.ts — getBrandingShell(portId)
  thin wrapper over getPortBrandingConfig() that returns null on
  error / missing portId so senders never break on misconfig.

All 6 transactional templates refactored to use renderShell + the
shared accent color; portName now flows through every template
(crm-invite, portal activation/reset, both inquiries, both
residential templates, notification digest).

All 6 senders pass branding via getBrandingShell:
- portal-auth.service.ts (activation + reset)
- crm-invite.service.ts (resend path; create-invite has no portId
  yet so falls through to defaults)
- email worker (inquiry confirmation + sales notification)
- residential-inquiries route (client confirmation + sales alert)
- notification-digest.service.ts (digest)

BrandedAuthShell takes an optional `branding` prop with logoUrl +
appName (parent page server-fetches via getPortBrandingConfig).
Defaults to Port Nimara if omitted, so single-tenant deployments
are unaffected.

1175/1175 vitest passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/email/branding-resolver.ts

@@ -0,0 +1,28 @@
+/**
+ * Resolve the per-port branding shell for transactional emails.
+ *
+ * Senders that have a portId call this once and pass the result into
+ * the email template. Senders without a portId (e.g. CRM invite at
+ * create-time before a port is selected) pass null — the shell
+ * falls back to the Port Nimara defaults.
+ */
+
+import { getPortBrandingConfig } from '@/lib/services/port-config';
+import type { BrandingShell } from '@/lib/email/shell';
+
+export async function getBrandingShell(
+  portId: string | null | undefined,
+): Promise<BrandingShell | null> {
+  if (!portId) return null;
+  try {
+    const cfg = await getPortBrandingConfig(portId);
+    return {
+      logoUrl: cfg.logoUrl,
+      primaryColor: cfg.primaryColor,
+      emailHeaderHtml: cfg.emailHeaderHtml,
+      emailFooterHtml: cfg.emailFooterHtml,
+    };
+  } catch {
+    return null;
+  }
+}