refactor(CVG-49): extract @cv/mail package; api no longer composes mail directly
Mail (Resend provider, console provider, Handlebars template service, MailService interface) lived in @cv/core/modules/mail despite being a self-contained side-effect concern. Extracted to packages/mail mirroring @cv/auth/@cv/file-storage/@cv/handlers shape. api no longer imports ResendModule/TemplateModule - sending password reset / verification email is core's auth-domain concern, api stays a thin GraphQL shell. core/auth/providers/password and core/authentication import @cv/mail directly. Verified by full docker compose rebuild + boot.