feat: mail service

gateway/README.md

@@ -116,14 +116,19 @@ The public auth JSON contract uses a challenge-token flow:
   `client_public_key`, and `time_zone`, then returns
   `device_session_id`.
 
+The JSON body for `send-email-code` remains unchanged, but gateway may also
+consume the standard `Accept-Language` header on that route. Gateway resolves
+the first supported BCP 47 language tag, falls back to `en` when needed, and
+forwards that derived preferred-language candidate to
+`Auth / Session Service` for localized auth mail and possible first-user
+creation. The public JSON DTO itself remains unchanged.
 `client_public_key` is the standard base64-encoded raw 32-byte Ed25519 public
 key for the device session being created.
 `time_zone` is the client-selected IANA time zone name forwarded unchanged to
 `Auth / Session Service`.
-The current create-path source of truth for `preferred_language` is still the
-temporary authsession-to-user rollout using `"en"`. Gateway-side language
-derivation is a later rollout. The public `confirm-email-code` DTO itself
-remains unchanged.
+The current create-path source of truth for `preferred_language` is the
+language candidate derived from public `Accept-Language`, with fallback to
+`en`. The public `confirm-email-code` DTO itself remains unchanged.
 
 These routes remain unauthenticated and delegate only through an injected
 `AuthServiceClient`.