Saves a host-drafted reply without calling a model or sending email

Each pending draft includes review_url: a private link where a person can read the exact email (from, to, subject, body) and send or discard it without signing in. Anyone with the link can do that, so share it only with the person who should decide. It expires after review_expires_at, and stops working once the draft is sent, discarded or edited (an edit returns a new link). Other drafts have review_url null.