feat(email): weekly-digest once-per-week guard + deploy success emails

[mastermanas805]

Two fixes, both verified against the prod audit_log (not just code).

1. Weekly digest fired daily, not weekly

Prod ledger showed digest.weekly rows on 2026-05-25 / 26 / 27 / 28 — every non-anonymous team got the "weekly summary" four days in a row (reported by @mastermanas805).

Root cause: the once-per-week guarantee lived only in River's periodic schedule (mondayAt8UTCSchedule + UniqueOpts{ByPeriod: 7d}). The worker auto-deploys on every push to master, so it restarts often; River's catch-up enqueue on startup re-ran the sweep on consecutive days and the 7-day unique window did not hold across restarts.

Fix: the candidate query now has a NOT EXISTS guard excluding any team with a digest.weekly row inside weeklyDigestDedupeWindow ("6 days") — the "dedupe lives in the DB" pattern from expiry_reminder.go / quota_wall_nudge.go. Cadence is now correct regardless of how often River fires.

2. No email on deployment

api writes deploy.created + deploy.healthy audit rows on every deploy, but the email forwarder had no path for them — the rows landed and were silently dropped. (Same omission class as 49639e7 / W2.)

Fix: registered both kinds in supportedAuditKinds + eventEmailBuilders + eventEmailBodyRenderers with Go-rendered bodies — a "deployment started" email on create and a "your app is live at " email on healthy. Pairs with the api PR that adds app_url/app_name/env to the deploy.healthy audit metadata.

Tests

• deploy_success_email_test.go — builders flow metadata, healthy renderer surfaces the live URL (+ dashboard fallback), created email never invents a URL, fail-soft on no recipient.
• weekly_digest_test.go — pins the once-per-week guard args on the candidate query.
• Existing registry-iterating tests now validate the new kinds.

Verification status

Local: build + vet clean, internal/jobs package green. Not yet verified live — and transactional email is still blocked in prod by the unvalidated Brevo sender (project_brevo_sender_not_validated) until noreply@instanode.dev is validated.

🤖 Generated with Claude Code