test+docs(email): squat-fix coverage and the email-pipeline docs

Add an integration test asserting the guest-until-confirmed squat fix (an
email-login account is a reapable guest until the code is confirmed, then
durable). Document the branded relay pipeline in ARCHITECTURE (go-mail, TLS by
port, no client cert, PUBLIC_BASE_URL anti-injection, per-recipient send throttle,
guest-until-confirmed), FUNCTIONAL (+ru), TESTING and the backend README config
table (BACKEND_SMTP_* + BACKEND_PUBLIC_BASE_URL).

docs/ARCHITECTURE.md

@@ -232,9 +232,17 @@ arrive from a platform rather than completing a mandatory registration).
   `confirmed` flag. A synthetic `kind='robot'` identity backs each pooled
   robot opponent (§7). The **email confirm-code flow** binds an email to the
   authenticated account: a 6-digit code (stored only as a SHA-256 hash, 15-minute
-  TTL, ≤ 5 attempts) is sent through a `Mailer` seam (an SMTP relay, or a
-  development log mailer when none is configured) and, once verified, attaches a
-  confirmed email identity. Accounts and identities use application-generated
+  TTL, ≤ 5 attempts) is sent as a **branded HTML + plain-text email** through a
+  `Mailer` seam (go-mail over the shared relay — implicit TLS on port 465 or
+  STARTTLS, the server certificate validated against the system roots, no client
+  certificate; a development log mailer when no relay is configured) and, once
+  verified, attaches a confirmed email identity. Sends are throttled per recipient
+  (a 60-second cooldown and a five-per-hour cap). Links in the email are built from
+  a configured public base URL, never a request Host header (anti-injection). An
+  **email-login** account is created flagged `is_guest` and stays reapable until the
+  code is confirmed — so an abandoned, never-confirmed login frees its reserved
+  address — with confirming clearing the flag. Accounts and identities use
+  application-generated
   **UUIDv7** primary keys. A service flag `paid_account` (lifetime one-time
   payment; no purchase flow yet) is carried on the account and ORed on a merge.
 - **Linking** is initiated from an authenticated profile and proves