feat(email): replace Resend with Cloudflare Email Service

[Makisuo]

What

Replaces Resend with Cloudflare Email Service ("Email Sending", public beta) for all transactional email — the onboarding sequence and the weekly digest. The Cloudflare account already has noreply.maple.dev onboarded (DNS configured, enabled, 1000/day quota), so delivery now goes through the native EMAIL worker binding — no API key/secret.

Why

Drop the external Resend dependency (API key secret + raw HTTP call) in favor of the platform-native sender, with zero changes to email content or send-site logic.

Changes

• apps/api/src/lib/EmailService.ts — resolves the send_email binding from WorkerEnvironment and calls env.EMAIL.send({ from, to, subject, html, replyTo }). The public send(to, subject, html, replyTo?) signature and EmailDeliveryError are unchanged, so OnboardingEmailService / DigestService and the React Email templates are untouched. isConfigured now reflects binding presence; 15s timeout, PII rules, and logging preserved; span email.provider="cloudflare" + email.message_id.
• apps/api/src/lib/Env.ts — drop RESEND_API_KEY / RESEND_FROM_EMAIL, add EMAIL_FROM (default Maple <notifications@noreply.maple.dev>).
• alchemy + wrangler (api + alerting) — add the EmailSender / send_email binding, swap RESEND_FROM_EMAIL → EMAIL_FROM, remove the RESEND_API_KEY secret.
• apps/alerting/src/worker.ts — feed WorkerEnvironment.layer into EmailServiceLive (the api worker already provides it at app scope).
• Cleanup: stale comment in OnboardingEmailService.ts, .env.local, README.md.

Sender identity unchanged: From noreply.maple.dev, Reply-To david@maple.dev on the founder/onboarding emails only.

Verification

• ✅ bun typecheck — all 24 packages pass.
• ✅ bun run --cwd apps/api test — 631/631 pass. Outside a worker isolate EMAIL is undefined → isConfigured=false, sends skip (no regression).

Follow-up (needs a deploy)

• Deploy to a PR-preview/staging stage, confirm the EMAIL binding attaches, fire one real send, and check the Email Sending dashboard counter + delivery. Watch for E_SENDER_NOT_VERIFIED (would mean EMAIL_FROM/allowedSenderAddresses don't match the onboarded noreply.maple.dev domain).
• Note: wrangler configs use remote: true, so wrangler dev sends through the real Cloudflare sender; pure bun dev stays a no-op.

🤖 Generated with Claude Code

[pullfrog]

Your LLM provider API key was rejected. Rotate the key in your provider dashboard, then update the matching GitHub Actions secret.

Update repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ ⚠️ this action is pinned to a commit SHA, which freezes the cleanup step — switch to @v0 or keep the SHA fresh with Dependabot ｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}