Implement Workstream G: Email Service with Postmark

- Add postmark dependency and email configuration constants
- Implement sendVerificationEmail, sendPasswordResetEmail,
  sendLoginConfirmationEmail, and sendOrgInviteEmail helpers
- Add HTML + text email templates with inline CSS
- Support dev mode (EMAIL_DEV_MODE=true) for console logging
- Use URL constructor for proper URL building
- Add XSS protection with HTML escaping in templates
- Create .env file with email environment variables

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api-server/src/constants.ts

@@ -27,3 +27,31 @@ export const getAllowedOrigins = (): string[] => {
     "http://localhost:6828",
   ];
 };
+
+// ===== Email Configuration =====
+
+/** Email sender address */
+export const EMAIL_FROM = Bun.env.EMAIL_FROM ?? "noreply@reviq.io";
+
+/** Base URL for generating email links */
+export const BASE_URL = Bun.env.BASE_URL ?? "http://localhost:6827";
+
+/** Dev mode: log emails instead of sending (default: true) */
+export const EMAIL_DEV_MODE = Bun.env.EMAIL_DEV_MODE !== "false";
+
+/** Postmark API key (required when EMAIL_DEV_MODE is false) */
+export const POSTMARK_API_KEY = Bun.env.POSTMARK_API_KEY;
+
+// ===== Token Expiration Times =====
+
+/** Email verification token expiry in hours */
+export const EMAIL_VERIFICATION_EXPIRY_HOURS = 24;
+
+/** Password reset token expiry in hours */
+export const PASSWORD_RESET_EXPIRY_HOURS = 1;
+
+/** Login confirmation token expiry in minutes */
+export const LOGIN_CONFIRMATION_EXPIRY_MINUTES = 15;
+
+/** Org invite token expiry in days */
+export const ORG_INVITE_EXPIRY_DAYS = 7;