auto mail generation

.env.example

@@ -120,6 +120,55 @@ EMBEDDING_DIMENSIONS=0
 # ── Geocoding ───────────────────────────────────────────────────────────────
 # Google Geocoding when set; OpenStreetMap's Nominatim otherwise.
 GEOCODER_API_KEY=
+# ── Email ───────────────────────────────────────────────────────────────────
+#
+# Sending the first-password invitation a newly onboarded merchant receives.
+# Without MAIL_HOST the server still boots and still onboards tenants — the
+# create response comes back `invited: false` with the reason — but nobody is
+# emailed, and the only way into a new account is a Nearle staff member using
+# Resend invite.
+#
+# SMTP, because every provider speaks it. Any transactional service is the same
+# five variables: its host, 587, the API key as MAIL_PASSWORD, and whatever
+# username it documents.
+#
+# WE RUN POSTAL — a self-hosted transactional mail server. Its SMTP endpoint is
+# the host below, and the credentials are a per-application pair generated in
+# Postal's UI, NOT a mailbox login. See docs/MAIL_SETUP.md for standing it up
+# and for the DNS records, which are what actually decide whether the invitation
+# reaches an inbox.
+#
+#   Postal (ours):      postal.nearledaily.com  587   credentials per-app
+#   Gmail / Workspace:  smtp.gmail.com          587   an app password, and only
+#                                                     ever for a smoke test
+#   Amazon SES:         email-smtp.<region>.amazonaws.com  587
+#   SendGrid:           smtp.sendgrid.net       587   username literally "apikey"
+#   Resend:             smtp.resend.com         587   username literally "resend"
+MAIL_HOST=
+MAIL_PORT=587
+# Optional. Leave both empty for a relay that authenticates by network rather
+# than by credentials.
+MAIL_USERNAME=
+MAIL_PASSWORD=
+# Who the invitation appears to come from. Separate from MAIL_USERNAME because
+# most providers authenticate as one identity and send as another, and using
+# the login as the From address is how mail lands in spam.
+#
+# ON NEARLEDAILY.COM, DELIBERATELY. The link in the mail points at
+# app.nearledaily.com, and a password link arriving from a DIFFERENT domain than
+# the one it sends you to is the exact shape of a phishing mail — to a filter
+# and to the merchant reading it. Sender and link stay on one domain.
+#
+# `care@` rather than `no-reply@`, also deliberately: somebody who replies "I
+# never got this" is the single most useful reply this system can receive, and
+# it should reach a person.
+MAIL_FROM=care@nearledaily.com
+MAIL_FROM_NAME=Nearle
+# Where the invitation link points — the MERCHANT console, always. A merchant
+# sets their password there and nowhere else, so this is never the platform
+# console's address.
+MAIL_CONSOLE_URL=https://app.nearledaily.com
+
 
 # ── Nearle Buddy ────────────────────────────────────────────────────────────
 #