feat: admin email hub — sent log, inbox, compose, audiences, delivery tracking

Add full email management at /admin/emails with:
- email_log table tracking all outgoing emails with resend_id + delivery events
- inbound_emails table for Resend webhook-received messages
- Resend webhook handler (/webhooks/resend) updating delivery status in real-time
- send_email() returns resend_id (str|None) instead of bool; all 9 worker
  handlers pass email_type= for per-type filtering
- Admin UI: sent log with HTMX filters, email detail with API-enriched HTML
  preview, inbox with unread badges + reply, compose with branded wrapping,
  audience management with contact list/remove
- Sidebar Email section with unread badge via blueprint context processor

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -81,6 +81,8 @@ DUCKDB_PATH=local.duckdb SERVING_DUCKDB_PATH=analytics.duckdb \
 | Extraction patterns, state tracking, adding new sources | `extract/padelnomics_extract/README.md` |
 | 3-layer SQLMesh architecture, materialization strategy | `transform/sqlmesh_padelnomics/README.md` |
 | Two-file DuckDB architecture (SQLMesh lock isolation) | `src/padelnomics/export_serving.py` docstring |
+| Email hub: delivery tracking, webhook handler, admin UI | `web/src/padelnomics/webhooks.py` docstring |
+| User flows (all admin + public routes) | `docs/USER_FLOWS.md` |
 
 ## Pipeline data flow
 
@@ -103,6 +105,7 @@ analytics.duckdb            ← serving tables only, web app read-only
 | `LANDING_DIR` | `data/landing` | Landing zone root (extraction writes here) |
 | `DUCKDB_PATH` | `local.duckdb` | SQLMesh pipeline DB (exclusive write) |
 | `SERVING_DUCKDB_PATH` | `analytics.duckdb` | Read-only DB for web app |
+| `RESEND_WEBHOOK_SECRET` | `""` | Resend webhook signature secret (skip verification if empty) |
 
 
 ## Coding philosophy