feat(mails): send supplier document requests over each store's own SMTP

Replaces the mailto: link with a server-side send, so the message carries the
store's signature and logo instead of depending on each workstation's Outlook.

Store record (groups):
- address, phone and logo (data URI, 200 KB cap) feed the mail signature
- per-store SMTP settings: host, port, SSL/STARTTLS, credentials, sender
  address and display name, with an enable switch
- "test connection" button verifies the server without sending anything
- the empty-form literal, previously repeated five times, becomes one constant

Sending:
- nodemailer transport built per store from its own settings
- multipart mail: plain-text alternative plus HTML whose signature embeds the
  logo as an inline CID attachment, which Outlook renders without the remote
  image blocking that a data: URI would hit
- delivery details are HTML-escaped
- Reply-To set to the store address; the row shows a spinner and refuses a
  second click while a send is in flight

Credentials:
- the SMTP password is never returned to the client; a response-layer
  sanitizer strips it from every /api payload and replaces it with a
  smtpPasswordSet flag, covering the ten-plus queries that join full group
  rows into deliveries, orders and user relations
- an empty password field on save keeps the stored one rather than clearing it

Verified end-to-end against a local SMTP server: transport, auth, From/Reply-To,
multipart structure and the inline logo attachment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FHdE9nEh8zHhQNGpCgrtYe

server/migrations.ts

@@ -60,12 +60,30 @@ export async function runMigrations() {
 );
 
 INSERT INTO webhook_bap_config (name, webhook_url, description, is_active)
-SELECT 
+SELECT
   'Configuration BAP',
   'https://workflow.ffnancy.fr/webhook/a3d03176-b72f-412d-8fb9-f920b9fbab4d',
   'Configuration par défaut pour envoi des fichiers BAP vers n8n',
   true
 WHERE NOT EXISTS (SELECT 1 FROM webhook_bap_config);`
+      },
+      {
+        filename: '20260814000000_add_store_contact_and_smtp_to_groups.sql',
+        content: `
+          -- Coordonnées du magasin (signature des mails fournisseurs)
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS address TEXT;
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS phone VARCHAR(50);
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS logo TEXT;
+          -- Configuration SMTP propre à chaque magasin
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_enabled BOOLEAN DEFAULT false;
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_host VARCHAR(255);
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_port INTEGER;
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_secure BOOLEAN DEFAULT false;
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_user VARCHAR(255);
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_password VARCHAR(255);
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_sender_email VARCHAR(255);
+          ALTER TABLE groups ADD COLUMN IF NOT EXISTS smtp_sender_name VARCHAR(255);
+        `
       }
     ];