SES: switch production auth to SES and soak-test

[mroderick]

Depends on the IAM credentials issue and the dual-path transport issue.

• Set MAIL_TRANSPORT=ses on the production auth app
• Trigger a real magic-link sign-in and confirm delivery
• Confirm DKIM alignment and that the mail arrives in Gmail/Outlook inboxes rather than spam
• Watch the app logs (pino) for send errors for about a week
• If anything looks wrong: rollback is MAIL_TRANSPORT=sendgrid — the SendGrid path and key stay intact during this soak

There is no staging auth app — auth.codebar.io (production) serves both the production and staging planners, so unlike planner's migration this soak runs directly in production. Magic-link volume is low and the SendGrid fallback makes failure recoverable, hence ~1 week rather than planner's two-week window (adjustable).

Note: planner's apps remain on SendGrid until its own cutover completes (codebar/planner#2929) — auth's soak does not depend on that.