feat(mails): send supplier document requests over each store's own SMTP

Replaces the mailto: link with a server-side send, so the message carries the
store's signature and logo instead of depending on each workstation's Outlook.

Store record (groups):
- address, phone and logo (data URI, 200 KB cap) feed the mail signature
- per-store SMTP settings: host, port, SSL/STARTTLS, credentials, sender
  address and display name, with an enable switch
- "test connection" button verifies the server without sending anything
- the empty-form literal, previously repeated five times, becomes one constant

Sending:
- nodemailer transport built per store from its own settings
- multipart mail: plain-text alternative plus HTML whose signature embeds the
  logo as an inline CID attachment, which Outlook renders without the remote
  image blocking that a data: URI would hit
- delivery details are HTML-escaped
- Reply-To set to the store address; the row shows a spinner and refuses a
  second click while a send is in flight

Credentials:
- the SMTP password is never returned to the client; a response-layer
  sanitizer strips it from every /api payload and replaces it with a
  smtpPasswordSet flag, covering the ten-plus queries that join full group
  rows into deliveries, orders and user relations
- an empty password field on save keeps the stored one rather than clearing it

Verified end-to-end against a local SMTP server: transport, auth, From/Reply-To,
multipart structure and the inline logo attachment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FHdE9nEh8zHhQNGpCgrtYe

server/migrations.production.ts

@@ -58,7 +58,24 @@ export async function runProductionMigrations() {
     } else {
       console.log('✅ MIGRATION: Priority column already exists, skipping migration');
     }
-    
+
+    // Coordonnées magasin + configuration SMTP par magasin (mails fournisseurs)
+    console.log('🔄 MIGRATION: Ensuring store contact and SMTP columns on groups...');
+    await client.query(`
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS address TEXT;
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS phone VARCHAR(50);
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS logo TEXT;
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_enabled BOOLEAN DEFAULT false;
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_host VARCHAR(255);
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_port INTEGER;
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_secure BOOLEAN DEFAULT false;
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_user VARCHAR(255);
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_password VARCHAR(255);
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_sender_email VARCHAR(255);
+      ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_sender_name VARCHAR(255);
+    `);
+    console.log('✅ MIGRATION: Store contact and SMTP columns are present on groups');
+
   } catch (error) {
     console.error('❌ MIGRATION ERROR: Failed to run SAV production migrations:', error);
     console.error('❌ MIGRATION ERROR: Error details:', {