feat(branding): wire per-port branding through every transactional email + auth shell (R2-H15)

Multi-tenant branding admin (/admin/branding) was saving 5 settings
that no code read — every port's emails shipped Port Nimara's logo
and color regardless. Now wired end-to-end:

New shared infrastructure:
- src/lib/email/shell.ts — renderShell() + brandingPrimaryColor()
  helpers; takes BrandingShell { logoUrl, primaryColor,
  emailHeaderHtml, emailFooterHtml }, falls back to Port Nimara
  defaults when null.
- src/lib/email/branding-resolver.ts — getBrandingShell(portId)
  thin wrapper over getPortBrandingConfig() that returns null on
  error / missing portId so senders never break on misconfig.

All 6 transactional templates refactored to use renderShell + the
shared accent color; portName now flows through every template
(crm-invite, portal activation/reset, both inquiries, both
residential templates, notification digest).

All 6 senders pass branding via getBrandingShell:
- portal-auth.service.ts (activation + reset)
- crm-invite.service.ts (resend path; create-invite has no portId
  yet so falls through to defaults)
- email worker (inquiry confirmation + sales notification)
- residential-inquiries route (client confirmation + sales alert)
- notification-digest.service.ts (digest)

BrandedAuthShell takes an optional `branding` prop with logoUrl +
appName (parent page server-fetches via getPortBrandingConfig).
Defaults to Port Nimara if omitted, so single-tenant deployments
are unaffected.

1175/1175 vitest passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/crm-invite.service.ts

@@ -10,6 +10,7 @@ import { env } from '@/lib/env';
 import { sendEmail } from '@/lib/email';
 import { crmInviteEmail } from '@/lib/email/templates/crm-invite';
 import { resolveSubject } from '@/lib/email/resolve-subject';
+import { getBrandingShell } from '@/lib/email/branding-resolver';
 import { CodedError, ConflictError, NotFoundError, ValidationError } from '@/lib/errors';
 import { hashToken, mintToken } from '@/lib/portal/passwords';
 
@@ -230,12 +231,16 @@ export async function resendCrmInvite(
     .where(eq(crmUserInvites.id, inviteId));
 
   const link = `${env.APP_URL}/set-password?token=${raw}`;
-  const result = crmInviteEmail({
-    link,
-    ttlHours: INVITE_TTL_HOURS,
-    recipientName: invite.name ?? undefined,
-    isSuperAdmin: invite.isSuperAdmin,
-  });
+  const branding = await getBrandingShell(meta.portId);
+  const result = crmInviteEmail(
+    {
+      link,
+      ttlHours: INVITE_TTL_HOURS,
+      recipientName: invite.name ?? undefined,
+      isSuperAdmin: invite.isSuperAdmin,
+    },
+    { branding },
+  );
   // Resend uses the dedicated portal_invite_resend key so admins can
   // word the resend differently from the original.
   const subject = await resolveSubject({
@@ -248,7 +253,7 @@ export async function resendCrmInvite(
       ttlHours: INVITE_TTL_HOURS,
     },
   });
-  await sendEmail(invite.email, subject, result.html, undefined, result.text);
+  await sendEmail(invite.email, subject, result.html, undefined, result.text, meta.portId);
 
   void createAuditLog({
     userId: meta.userId,

src/lib/services/notification-digest.service.ts

@@ -28,6 +28,7 @@ import { getPortReminderConfig } from '@/lib/services/port-config';
 import { env } from '@/lib/env';
 import { logger } from '@/lib/logger';
 import { resolveSubject } from '@/lib/email/resolve-subject';
+import { getBrandingShell } from '@/lib/email/branding-resolver';
 
 const DIGEST_LOOKBACK_MS = 24 * 60 * 60 * 1000;
 const MAX_ITEMS_PER_USER = 20;
@@ -103,6 +104,10 @@ export async function runNotificationDigest(now: Date = new Date()): Promise<Dig
 
     if (portUsers.length === 0) continue;
 
+    // Resolve branding once per port — every user on this port gets
+    // the same shell.
+    const branding = await getBrandingShell(port.id);
+
     const since = new Date(now.getTime() - DIGEST_LOOKBACK_MS);
 
     for (const u of portUsers) {
@@ -133,19 +138,22 @@ export async function runNotificationDigest(now: Date = new Date()): Promise<Dig
 
         const visible = rows.slice(0, MAX_ITEMS_PER_USER);
         const inboxLink = `${env.APP_URL}/notifications`;
-        const result = notificationDigestEmail({
-          portName: port.name,
-          recipientName: u.name ?? '',
-          items: visible.map((r) => ({
-            type: r.type,
-            title: r.title,
-            description: r.description,
-            link: r.link ? `${env.APP_URL}${r.link}` : null,
-            createdAt: r.createdAt,
-          })),
-          totalUnread: rows.length,
-          inboxLink,
-        });
+        const result = notificationDigestEmail(
+          {
+            portName: port.name,
+            recipientName: u.name ?? '',
+            items: visible.map((r) => ({
+              type: r.type,
+              title: r.title,
+              description: r.description,
+              link: r.link ? `${env.APP_URL}${r.link}` : null,
+              createdAt: r.createdAt,
+            })),
+            totalUnread: rows.length,
+            inboxLink,
+          },
+          { branding },
+        );
 
         // The per-port subject override key for the digest is the
         // existing 'crm_invite' / 'portal_*' family — digest is its own

src/lib/services/portal-auth.service.ts

@@ -9,6 +9,7 @@ import { env } from '@/lib/env';
 import { sendEmail } from '@/lib/email';
 import { activationEmail, resetEmail } from '@/lib/email/templates/portal-auth';
 import { loadSubjectOverride } from '@/lib/email/template-overrides';
+import { getBrandingShell } from '@/lib/email/branding-resolver';
 import {
   CodedError,
   ConflictError,
@@ -118,13 +119,14 @@ async function issueActivationToken(
 
   const link = `${env.APP_URL}/portal/activate?token=${encodeURIComponent(raw)}`;
   const subjectOverride = await loadSubjectOverride(portId, 'portal_activation');
+  const branding = await getBrandingShell(portId);
   const { subject, html, text } = activationEmail(
     {
       portName,
       link,
       ttlHours: ACTIVATION_TOKEN_TTL_HOURS,
     },
-    { subject: subjectOverride },
+    { subject: subjectOverride, branding },
   );
 
   try {
@@ -378,13 +380,14 @@ export async function requestPasswordReset(email: string): Promise<void> {
   const portName = port?.name ?? 'Port Nimara';
   const link = `${env.APP_URL}/portal/reset-password?token=${encodeURIComponent(raw)}`;
   const subjectOverride = await loadSubjectOverride(user.portId, 'portal_reset');
+  const branding = await getBrandingShell(user.portId);
   const { subject, html, text } = resetEmail(
     {
       portName,
       link,
       ttlMinutes: RESET_TOKEN_TTL_MINUTES,
     },
-    { subject: subjectOverride },
+    { subject: subjectOverride, branding },
   );
 
   try {