chore: seed script fix, migration generation, and resend migration

[kevinrutledge]

Developer

Kevin Rutledge

What changed?

Three changes for staging deployment and email infrastructure:

1. Seed script fix - added ALLOW_REMOTE_SEED env var bypass so the seed script works against TiDB Cloud staging (whose hostname contains "prod" in the gateway URL, triggering the safety regex)

2. Migration for contact group tables - added migration SQL for the 6 tables that were created via db push but had no migration files (contact_group, contact_group_member, sms_consent, email_suppression, message, message_recipient). Also includes referral column widening from the encryption PR. This fixes CI which runs migrations against a fresh MySQL.

3. Replace Nodemailer with Resend - switched from Nodemailer SMTP to Resend HTTP API for email delivery. Vercel blocks outbound SMTP from serverless functions. Resend uses HTTP requests which work on all platforms. Removed nodemailer and @types/nodemailer, added resend package. Zero npm audit vulnerabilities.

How to test

1. Run npm test - 237 tests pass
2. Run npm run build - succeeds
3. Run npx tsc --noEmit - zero type errors
4. Run npm audit - zero vulnerabilities
5. Seed script: ALLOW_REMOTE_SEED=true DATABASE_URL='tidb-url' npm run db:seed
6. Email tests verify Resend SDK mock (send, error handling, batching, headers, suppression)

Checklist

• Code works and is readable
• Tested locally
• Commits follow conventional commits
• Assigned reviewers