feat(email): phase 6 — replace Resend with Brevo transactional email

Removes resend npm dependency. Adds lib/notifications/mailer.ts with a
raw-HTTP Brevo wrapper (sendEmail + sendPasswordResetEmail). All three
notification files updated to use the new wrapper.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/notifications/effectiveness-recheck.ts

@@ -1,5 +1,5 @@
 import 'server-only'
-import { Resend } from 'resend'
+import { sendEmail } from '@/lib/notifications/mailer'
 import { asAdmin } from '@/lib/db/with-user'
 import { capaActions, incidents, users } from '@/lib/db/schema'
 import { and, eq, inArray, isNotNull, lt } from 'drizzle-orm'
@@ -58,8 +58,6 @@ export async function sendEffectivenessRecheckNotifications(): Promise<{ notifie
 
   if (!capas || capas.length === 0) return { notified: 0 }
 
-  const resend = new Resend(process.env.RESEND_API_KEY)
-  const from = process.env.RESEND_FROM_EMAIL ?? 'onboarding@resend.dev'
   const siteUrl = process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000'
 
   let whatsappPhoneId: string | null = null
@@ -99,11 +97,7 @@ export async function sendEffectivenessRecheckNotifications(): Promise<{ notifie
     `
     const text = `${roundLabel} effectiveness check for ${incidentRef}\nAction: ${capaDesc}\n${capaUrl}`
 
-    const { error } = await resend.emails.send({ from, to: [verifierEmail], subject, html, text })
-    if (error) {
-      console.error('Effectiveness recheck email error:', error)
-      continue
-    }
+    await sendEmail({ to: verifierEmail, subject, html, text })
 
     // WhatsApp (non-blocking, best-effort)
     if (whatsappPhoneId && whatsappToken && verifierPhone) {