Verify the app's from-address with its active email provider

Provider-side sender verification for the active email account. Managed Postmark re-checks the Whisperr-verified sending domain; Resend requires the from-address domain to be listed on the account with status verified; customer-owned Postmark is proven by sending a verification email to the requesting operator (or the supplied to_address). A successful check stamps sender_verified_at on the account, which BYOK email sends require. The stamp is cleared whenever the from-address or the account's credentials change.