feat: notification service

mail/README.md

@@ -42,6 +42,8 @@ Cross-service routing rules:
 - `Notification Service -> Mail Service` is asynchronous `Redis Streams`
 - `Geo Profile Service` must route optional admin e-mail through
   `Notification Service`, not directly to `Mail Service`
+- auth-code delivery remains a direct `Auth / Session Service -> Mail Service`
+  flow and does not pass through `Notification Service`
 
 ## Runtime Surface
 
@@ -192,6 +194,7 @@ Stable envelope fields:
 - `source`
 - `payload_mode`
 - `idempotency_key`
+- `requested_at_ms`
 - `request_id`
 - `trace_id`
 - `payload_json`
@@ -200,6 +203,16 @@ Contract rules:
 
 - async `source` is fixed to `notification`
 - supported `payload_mode` values are `rendered` and `template`
+- `Notification Service` uses only `payload_mode=template` for
+  notification-generated mail, even though the generic async contract keeps
+  both `rendered` and `template`
+- notification-owned `template_id` values are identical to the
+  `notification_type` vocabulary, for example `game.turn.ready` and
+  `lobby.membership.approved`
+- the real `Notification Service -> Mail Service` integration suite verifies
+  template-mode handoff for notification-owned mail
+- `requested_at_ms` stores the publisher-side original request timestamp in
+  Unix milliseconds
 - `request_id` and `trace_id` are observability-only metadata and do not
   participate in idempotency fingerprinting
 - malformed commands are metered, logged, and recorded as dedicated
@@ -338,6 +351,13 @@ Required auth fallback files:
 - `auth.login_code/en/subject.tmpl`
 - `auth.login_code/en/text.tmpl`
 
+Notification-owned English template directories are frozen by
+[`../notification/README.md`](../notification/README.md) and the service-local
+[`Notification Service` docs](../notification/docs/README.md).
+`auth.login_code` remains the required auth template family for the direct
+`Auth / Session Service -> Mail Service` flow and is not part of the
+notification-owned template set.
+
 Rendering rules:
 
 - the process loads the full catalog at startup