feat(email): system/user senderType + attachments

Composer validator now takes senderType (system|user) and an
attachments[] array, and the service dispatches across two paths:
the system path uses lib/email/index.ts with port-config noreply
identity and logs signed_doc_emailed when an attachment matches a
document's signed PDF; the user path stays on the existing personal-
account flow but is gated by the new email.allowPersonalAccountSends
toggle and the attachment fileIds are persisted on email_messages.
sendEmail in lib/email accepts attachments and resolves them from
MinIO with cross-port enforcement.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/email/index.ts

@@ -33,6 +33,11 @@ function createTransporterFromConfig(cfg: PortEmailConfig): Transporter {
   });
 }
 
+export interface EmailAttachmentRef {
+  fileId: string;
+  filename?: string;
+}
+
 export interface SendEmailOptions {
   to: string | string[];
   subject: string;
@@ -41,6 +46,50 @@ export interface SendEmailOptions {
   /** When provided, port-level email settings override env defaults. */
   portId?: string;
   text?: string;
+  /**
+   * File attachments to fetch from MinIO and attach to the message.
+   * Resolution + cross-port enforcement happens via `resolveAttachments`
+   * before the SMTP call.
+   */
+  attachments?: EmailAttachmentRef[];
+}
+
+/**
+ * Resolve attachment refs to nodemailer attachment payloads. Reads each file
+ * from MinIO and enforces port-isolation: an attachment that doesn't belong
+ * to `portId` throws ForbiddenError. Returns an empty array when no refs
+ * are provided.
+ */
+async function resolveAttachments(
+  refs: EmailAttachmentRef[] | undefined,
+  portId: string | undefined,
+): Promise<Array<{ filename: string; content: Buffer; contentType?: string }>> {
+  if (!refs || refs.length === 0) return [];
+  const { db } = await import('@/lib/db');
+  const { files } = await import('@/lib/db/schema/documents');
+  const { eq } = await import('drizzle-orm');
+  const { ForbiddenError, NotFoundError } = await import('@/lib/errors');
+  const { minioClient } = await import('@/lib/minio');
+
+  return Promise.all(
+    refs.map(async (ref) => {
+      const file = await db.query.files.findFirst({ where: eq(files.id, ref.fileId) });
+      if (!file) throw new NotFoundError('File');
+      if (portId && file.portId !== portId) {
+        throw new ForbiddenError('File belongs to a different port');
+      }
+      const stream = await minioClient.getObject(file.storageBucket, file.storagePath);
+      const chunks: Buffer[] = [];
+      for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      }
+      return {
+        filename: ref.filename ?? file.originalName,
+        content: Buffer.concat(chunks),
+        ...(file.mimeType ? { contentType: file.mimeType } : {}),
+      };
+    }),
+  );
 }
 
 /**
@@ -57,6 +106,7 @@ export async function sendEmail(
   from?: string,
   text?: string,
   portId?: string,
+  attachments?: EmailAttachmentRef[],
 ): Promise<nodemailer.SentMessageInfo> {
   const cfg = portId ? await getPortEmailConfig(portId) : null;
   const transporter = cfg ? createTransporterFromConfig(cfg) : createTransporter();
@@ -73,6 +123,8 @@ export async function sendEmail(
     env.SMTP_FROM ??
     `Port Nimara CRM <noreply@${env.SMTP_HOST}>`;
 
+  const resolvedAttachments = await resolveAttachments(attachments, portId);
+
   const info = await transporter.sendMail({
     from: fromHeader,
     to: effectiveTo,
@@ -80,6 +132,7 @@ export async function sendEmail(
     html,
     ...(cfg?.replyTo ? { replyTo: cfg.replyTo } : {}),
     ...(text ? { text } : {}),
+    ...(resolvedAttachments.length > 0 ? { attachments: resolvedAttachments } : {}),
   });
 
   logger.debug(