feat: mail service

user/README.md

@@ -111,10 +111,11 @@ decisions:
   - Existing users ignore the registration context completely.
   - Existing users must not have settings overwritten by a later auth flow.
 - The current rollout source of truth is:
-  - `Auth / Session Service` sends temporary `preferred_language="en"`
+  - `Auth / Session Service` forwards the preferred-language candidate derived
+    from public `Accept-Language`
+  - unsupported or missing public language input falls back to `en`
   - `Auth / Session Service` forwards the public confirm `time_zone`
-  - gateway-side geoip language derivation is not part of the current
-    contract yet
+  - the create-only registration context remains unchanged for existing users
 
 Auth-facing blocking semantics: