feat(admin): delete a whitelist entry, and stop hiding a broken mail setup

Three operator gaps, all found the same way — a person could not sign up and the
app showed nobody anything.

- DELETE /api/admin/invites/{id} with a delete control on both the pending
  requests and the previously-decided list. Deny keeps the row so the person
  cannot immediately re-ask; delete forgets the address. Refused with 409 while
  a User row exists for it, because is_allowed reads that row and removing it
  would revoke a live user's access with no other sign — the list ships
  has_account so the UI withholds the button instead of offering one that fails.
- Email is fail-soft by design, which had come to mean invisible. _send() now
  records an email_undelivered notification for every admin when a message is
  skipped or rejected, naming the message that was lost, throttled to one an
  hour. /api/me carries email_configured, driving a standing warning on
  Configuration → Email / SMTP and above the access-request list.
- The sign-in card's Create account / Forgot password / Didn't get the email
  views are history entries (useHistorySubview), so Back returns to the previous
  view instead of only moving the address bar.

Also: the per-test rate-limiter reset sweeps every loaded app.* module rather
than a hand-kept list of three — this change added a limiter outside it.

frontend/src/lib/api/account.ts

@@ -16,6 +16,8 @@ export interface Me {
   can_read: boolean;
   can_write: boolean;
   pending_invites: number;
+  /** Admin-only: false when SMTP is incomplete, so every outbound message is silently skipped. */
+  email_configured: boolean;
   preferences: Record<string, unknown>;
 }
 

frontend/src/lib/api/admin.ts

@@ -19,6 +19,9 @@ export interface Invite {
   requested_at: string | null;
   decided_at: string | null;
   decided_by: string | null;
+  /** An account already exists for this address, so the entry can't be deleted from here — deleting
+   *  it would revoke that user's access (is_allowed reads this row). Delete the user instead. */
+  has_account: boolean;
 }
 
 // Admin Configuration page: one DB-overridable setting (registry entry on the backend).
@@ -169,4 +172,5 @@ export const adminApi = {
   denyInvite: (id: number) => req(`/api/admin/invites/${id}/deny`, { method: "POST" }),
   addInvite: (email: string) =>
     req("/api/admin/invites", { method: "POST", body: JSON.stringify({ email }) }),
+  deleteInvite: (id: number) => req(`/api/admin/invites/${id}`, { method: "DELETE" }),
 };

frontend/src/lib/releaseNotes.ts

@@ -14,6 +14,24 @@ export interface ReleaseEntry {
 }
 
 export const RELEASE_NOTES: ReleaseEntry[] = [
+  {
+    version: "0.78.6",
+    date: "2026-09-01",
+    summary:
+      "Admins can now delete a whitelist entry, and an instance that cannot send email finally says so — in the inbox when a message is dropped, and on the screens where it matters.",
+    features: [
+      "Delete an entry from Users → Access requests: both a pending request and an address you whitelisted earlier. Denying a request keeps the row so the person cannot immediately re-ask; deleting forgets the address, and a later request from it starts over. An entry that already has an account behind it stays read-only — removing it would revoke that person's access without saying so, so delete the user instead.",
+      "When a message cannot go out, every admin gets it in their inbox, naming the message that was lost — an access request, a verification link, a password reset. Sending is deliberately fail-soft so a mail problem never breaks sign-up, but that used to mean it left no trace anywhere. Throttled to one notice an hour, so a dead relay cannot bury the inbox.",
+      "A standing warning where it can be acted on: on Configuration → Email / SMTP while the settings are incomplete, and above the access-request list, where it explains that nobody is getting a verification link and no request will reach you by email.",
+    ],
+    fixes: [
+      "On the sign-in card, Create an account / Forgot password / Didn't get the verification email are proper history steps now, so Back — including the mouse's back button — returns to the previous view. It used to move the address bar and leave the form on screen unchanged.",
+    ],
+    chores: [
+      "DELETE /api/admin/invites/{id}, refused with 409 while a User row exists for the address; the invite list carries has_account so the UI can withhold the affordance rather than offer a button that fails. Audited as invite_delete.",
+      "email._send() records an email_undelivered notification for every active admin on both the not-configured and the send-failed path, opening its own session and swallowing its own errors so the alert can never become a new way to break a send; /api/me carries email_configured for admins. The login card's mode moved to useHistorySubview, and the per-test rate-limiter reset now sweeps every loaded app.* module instead of a hand-kept list — this release added a limiter outside it.",
+    ],
+  },
   {
     version: "0.78.5",
     date: "2026-09-01",