Resend Delivery Webhook

Record what Resend did with an access email (TOS-4110).

access_email_deliveries has always logged what we handed the provider and never what the provider did with it, so an invitation that hard-bounced was indistinguishable from one that landed - and the person waiting for access simply never heard from us.

The Svix signature is the ONLY authentication on this route, exactly as the Stripe signature is on _stripe_webhook, so a body that fails verification is rejected before it is parsed. An unset secret is a 503 rather than an open door: a self-hosted install with no Resend account must not expose an unauthenticated write path.

async def only for await request.body(); the signature is over the RAW bytes, so the body cannot be read through a parsed model.