Validate SMTP sender aliases and surface effective sender in outreach flows

[AJaySi]

Motivation

• Prevent arbitrary from_email values from being used for SMTP sends and surface why a send was rejected.
• Ensure the persisted outreach attempt records include the effective sender actually used for policy/audit and UI confirmation.
• Provide structured failure reasons from the sender layer so the router and frontend can report actionable errors.

Description

• Add SMTP_ALLOWED_FROM_EMAILS and implement sender authorization in backend/services/backlink_outreach_sender.py with validate_sender_alias, SenderAuthorizationResult, and SendEmailResult, normalizing aliases and including configured SMTP_FROM_EMAIL/SMTP_USERNAME as allowed aliases.
• Change send_email to return a SendEmailResult, reject unauthorized from_email values, and include the effective sender and failure reason codes on failure.
• In backend/routers/backlink_outreach.py validate payload.sender_email before creating the outreach request, use the validated effective sender when creating the attempt, pass from_email=payload.sender_email to send_email only after validation, and merge send-layer failure reasons into the response.
• Persist and return the effective sender by adding effective_sender_email to SendOutreachResponse (backend/services/backlink_outreach_models.py and backend/services/backlink_outreach_service.py) and update the frontend API type (frontend/src/api/backlinkOutreachApi.ts).
• Update the dashboard UI (frontend/src/components/BacklinkOutreach/BacklinkOutreachDashboard.tsx) to display the effective sender in latest-attempt cards and the attempt history table header.

Testing

• Compiled Python modules with python -m py_compile backend/services/backlink_outreach_sender.py backend/routers/backlink_outreach.py backend/services/backlink_outreach_models.py backend/services/backlink_outreach_service.py, which succeeded.
• Ran a small integration script with PYTHONPATH=backend python to exercise BacklinkOutreachSender.validate_sender_alias and it passed local alias-normalization and rejection assertions.
• Attempted frontend type-check with cd frontend && npx tsc --noEmit, which failed in this environment due to missing Node type definitions and a TypeScript configuration deprecation, so frontend build/type-check could not be fully validated here.

---

Codex Task