[codex] Add 508 members newsletter sync

[michaelmwu]

Summary

• add shared Brevo, Keila, and Migadu newsletter-sync helpers
• keep /create-mailbox, /create-user-accounts, and agent account provisioning on direct best-effort newsletter sync for mailbox plus backup email
• add weekly Migadu -> 508 members newsletter reconciliation that skips configured system mailboxes, CRM-blocked contacts, and provider-suppressed contacts
• add worker job, API scheduler, and admin dashboard manual trigger for 508 members newsletter sync
• support Brevo list lookup by BREVO_508_MEMBERS_NEWSLETTER_LIST_NAME with production override BREVO_508_MEMBERS_NEWSLETTER_LIST_ID=4
• support Keila project contacts using contact data audiences: ["508_members"] for segmenting

Validation

• uv run pytest tests/ -q
• uv run pytest tests/unit/test_brevo_client.py tests/unit/test_keila_client.py tests/unit/test_newsletter_sync.py tests/unit/test_migadu_create_mailbox.py tests/unit/test_crm_create_sso_user.py tests/unit/test_shared_settings.py tests/unit/test_agent_gateway.py tests/unit/test_backend_api.py
• ./scripts/lint.sh
• ./scripts/mypy.sh
• pre-commit hook: ruff, ruff format, mypy

Frontend verification note

• bun run lint passes through ./scripts/lint.sh
• bun run typecheck is blocked in this workspace because apps/admin_dashboard/node_modules has TypeScript 5.9.3 and is missing local typescript/@types/bun, while the lockfile expects TypeScript 6.0.3 and @types/bun
• bun run test is blocked because local vitest is missing from node_modules

Notes

• Production should set BREVO_508_MEMBERS_NEWSLETTER_LIST_ID=4; non-prod can omit it and rely on list-name lookup or leave Brevo disabled.
• Keila does not expose Brevo-style contact lists in the documented API; this sync writes contact data for a 508_members audience so Keila segments can target it.

Summary by CodeRabbit

• New Features
  • Added newsletter contact syncing via Brevo and Keila, subscribing both the 508 mailbox email and its backup email to the configured audience/list.
  • Added an admin dashboard “Sync newsletters” action with dry-run support, loading feedback, and job/queue results.
  • Added periodic automated syncing using the 508 mailbox source-of-truth, with configurable intervals and excluded mailboxes.
• Improvements
  • Added newsletter suppression visibility in the dashboard and best-effort newsletter sync warnings (no blocking).
  • Improved privacy by redacting email addresses in errors and previews.
• Documentation
  • Updated environment and configuration docs for dashboard-managed locking and newsletter sync setup guidance.