fix: preserve email retries until attempts exhaust

[vladbisceanu]

What changed

The email worker currently writes FAILED after the first exception, so BullMQ retries find a non-PENDING row and exit without reaching SES again.

This patch:

• keeps explicit retryable SES failures PENDING until the configured attempts are exhausted
• retries only SES throttling/service responses; ambiguous transport failures stop without risking a duplicate
• checkpoints successful SES acceptance on the BullMQ job before database finalization, so a Postgres outage can recover without another send
• makes phishing failures terminal
• preserves accepted messages when later billing, event, or campaign bookkeeping fails

Verification

• real BullMQ worker coverage for retry success, terminal exhaustion, database recovery, dual Redis/Postgres failure, ambiguous SES transport loss, and post-send failure (17/17 focused tests)
• focused ESLint on the three changed files
• yarn turbo build --filter=api (5/5 tasks)
• two local review passes; all P1/P2 findings resolved