Email Test Send

Render one catalog email with sample values and send it directly (admin verification only).

The audit row is written and COMMITTED BEFORE the provider call, not queued afterwards. This route puts real mail into a real mailbox, at a caller-chosen address, from a caller-chosen sender, so "we emailed someone and there is no record" must be unreachable. The post-commit side-effect dispatcher cannot promise that: it runs after the transaction closes, writes in its own session, and logs its failures instead of raising (dependencies/audit.py), so a queued row can silently never land.

Ordering it before the send trades one honest failure mode for an unacceptable one. A row can now exist for a send the provider then refused (over-recording, visible and harmless); a send can never exist without a row (under-recording, the state the approval was about). It records the REQUEST for that reason, and says so in its action name: platform_audit_logs is append-only behind a prevent_mutation() trigger, so the row cannot be updated afterwards with the delivery outcome. That outcome stays in the structured log below and in the response.