feat(branding): wire per-port branding through every transactional email + auth shell (R2-H15)

Multi-tenant branding admin (/admin/branding) was saving 5 settings
that no code read — every port's emails shipped Port Nimara's logo
and color regardless. Now wired end-to-end:

New shared infrastructure:
- src/lib/email/shell.ts — renderShell() + brandingPrimaryColor()
  helpers; takes BrandingShell { logoUrl, primaryColor,
  emailHeaderHtml, emailFooterHtml }, falls back to Port Nimara
  defaults when null.
- src/lib/email/branding-resolver.ts — getBrandingShell(portId)
  thin wrapper over getPortBrandingConfig() that returns null on
  error / missing portId so senders never break on misconfig.

All 6 transactional templates refactored to use renderShell + the
shared accent color; portName now flows through every template
(crm-invite, portal activation/reset, both inquiries, both
residential templates, notification digest).

All 6 senders pass branding via getBrandingShell:
- portal-auth.service.ts (activation + reset)
- crm-invite.service.ts (resend path; create-invite has no portId
  yet so falls through to defaults)
- email worker (inquiry confirmation + sales notification)
- residential-inquiries route (client confirmation + sales alert)
- notification-digest.service.ts (digest)

BrandedAuthShell takes an optional `branding` prop with logoUrl +
appName (parent page server-fetches via getPortBrandingConfig).
Defaults to Port Nimara if omitted, so single-tenant deployments
are unaffected.

1175/1175 vitest passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/crm-invite.service.ts

@@ -10,6 +10,7 @@ import { env } from '@/lib/env';
 import { sendEmail } from '@/lib/email';
 import { crmInviteEmail } from '@/lib/email/templates/crm-invite';
 import { resolveSubject } from '@/lib/email/resolve-subject';
+import { getBrandingShell } from '@/lib/email/branding-resolver';
 import { CodedError, ConflictError, NotFoundError, ValidationError } from '@/lib/errors';
 import { hashToken, mintToken } from '@/lib/portal/passwords';
 
@@ -230,12 +231,16 @@ export async function resendCrmInvite(
     .where(eq(crmUserInvites.id, inviteId));
 
   const link = `${env.APP_URL}/set-password?token=${raw}`;
-  const result = crmInviteEmail({
-    link,
-    ttlHours: INVITE_TTL_HOURS,
-    recipientName: invite.name ?? undefined,
-    isSuperAdmin: invite.isSuperAdmin,
-  });
+  const branding = await getBrandingShell(meta.portId);
+  const result = crmInviteEmail(
+    {
+      link,
+      ttlHours: INVITE_TTL_HOURS,
+      recipientName: invite.name ?? undefined,
+      isSuperAdmin: invite.isSuperAdmin,
+    },
+    { branding },
+  );
   // Resend uses the dedicated portal_invite_resend key so admins can
   // word the resend differently from the original.
   const subject = await resolveSubject({
@@ -248,7 +253,7 @@ export async function resendCrmInvite(
       ttlHours: INVITE_TTL_HOURS,
     },
   });
-  await sendEmail(invite.email, subject, result.html, undefined, result.text);
+  await sendEmail(invite.email, subject, result.html, undefined, result.text, meta.portId);
 
   void createAuditLog({
     userId: meta.userId,