fbcc108341
Covers NOTIFY-04: per-send getDecryptedSmtpConfig(tenantId) SMTP resolution, fresh nodemailer transport + close() in finally (WR-01), no-throw skip on missing SmtpConfig, sectioned digest body without blind Number() coercion of estimatedValue, and HTML-escaping of tender titles/profile names (T-12-08 email-injection guard). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>