#709 Test

Summary by cubic

Adds POST /api/emails to send account‑scoped emails and unifies auth so recoup_sk_ keys work via Authorization: Bearer and x-api-key, with recipient limits unless a payment method is on file.

• New Features

  • POST /api/emails: send via Resend from “Agent by Recoup agent@recoupable.com”.
  • Validates body (to, optional cc, subject, text/html, headers, chat_id).
  • Enforces recipient gate: without a card on file, to/cc must be the account’s own email (403 otherwise).
  • CORS preflight (OPTIONS) and no-cache response.

• Refactors

  • Auth: getAuthenticatedAccountId accepts recoup_sk_ via Bearer; getApiKeyAccountId delegates to shared getAccountIdByApiKey (includes expires_at TTL check).
  • Stripe: new accountHasPaymentMethod helper; reused in Songstats gate.
  • Agent env: tests ensure the access token (JWT or recoup_sk_) surfaces as RECOUP_ACCESS_TOKEN.

Summary by CodeRabbit

• New Features
  • Added a new email-sending endpoint with support for request validation and reliable success/error responses.
  • Improved API access handling so valid API keys can be used for authenticated requests.
• Bug Fixes
  • Tightened email recipient checks to prevent sending to unauthorized addresses when no payment method is on file.
  • Improved handling of different token types for authenticated requests.
• Chores
  • Updated developer-facing documentation for credential handling.