The customer e-mail's HTML body, server-rendered.

One of the handful of routes with no response_model: the body is a document, not JSON. Content-Security-Policy: default-src 'none' is the load-bearing header — the body interpolates operator-typed camera labels and LLM prose, every value HTML-escaped, and the CSP means that even a future escaping slip cannot load a script or a font from this response. The one thing it admits is an image from S3: the preview shows each card's snapshot through a short presigned URL (the mailed copy embeds the bytes instead), so img-src names S3 and nothing else.

Rendered from the CUSTOMER PROJECTION for every role — the e-mail is a customer artefact whoever is previewing it.