Send Tos Notice

Email every active user that the Terms have changed. Run once per release.

This is the notice half of notice-based consent: when CURRENT_TOS_REQUIRES_REACCEPT is False, nobody is blocked, so this email is the ONLY thing standing between a version bump and terms a user never heard about. Send it on the day you deploy the new text.

Idempotent per version. "Have we already told this user about THIS version?" is answered from action_audit rather than a new column — the same trick the idle-Unipile sweep uses for its warning (services/heartbeat.py). Re-running only picks up whoever was missed.

Delivery is recorded per user: send_email returns False on anything but a 2xx from Resend, and that lands as a failed audit row. When notice carries legal weight, "we sent it" has to be answerable per recipient, not assumed.

Defaults to dry_run — the first call prints the roster so it can be eyeballed before any mail goes out.