feat(admin): delete a whitelist entry, and stop hiding a broken mail setup

Three operator gaps, all found the same way — a person could not sign up and the
app showed nobody anything.

- DELETE /api/admin/invites/{id} with a delete control on both the pending
  requests and the previously-decided list. Deny keeps the row so the person
  cannot immediately re-ask; delete forgets the address. Refused with 409 while
  a User row exists for it, because is_allowed reads that row and removing it
  would revoke a live user's access with no other sign — the list ships
  has_account so the UI withholds the button instead of offering one that fails.
- Email is fail-soft by design, which had come to mean invisible. _send() now
  records an email_undelivered notification for every admin when a message is
  skipped or rejected, naming the message that was lost, throttled to one an
  hour. /api/me carries email_configured, driving a standing warning on
  Configuration → Email / SMTP and above the access-request list.
- The sign-in card's Create account / Forgot password / Didn't get the email
  views are history entries (useHistorySubview), so Back returns to the previous
  view instead of only moving the address bar.

Also: the per-test rate-limiter reset sweeps every loaded app.* module rather
than a hand-kept list of three — this change added a limiter outside it.

frontend/src/lib/releaseNotes.ts

@@ -14,6 +14,24 @@ export interface ReleaseEntry {
 }
 
 export const RELEASE_NOTES: ReleaseEntry[] = [
+  {
+    version: "0.78.6",
+    date: "2026-09-01",
+    summary:
+      "Admins can now delete a whitelist entry, and an instance that cannot send email finally says so — in the inbox when a message is dropped, and on the screens where it matters.",
+    features: [
+      "Delete an entry from Users → Access requests: both a pending request and an address you whitelisted earlier. Denying a request keeps the row so the person cannot immediately re-ask; deleting forgets the address, and a later request from it starts over. An entry that already has an account behind it stays read-only — removing it would revoke that person's access without saying so, so delete the user instead.",
+      "When a message cannot go out, every admin gets it in their inbox, naming the message that was lost — an access request, a verification link, a password reset. Sending is deliberately fail-soft so a mail problem never breaks sign-up, but that used to mean it left no trace anywhere. Throttled to one notice an hour, so a dead relay cannot bury the inbox.",
+      "A standing warning where it can be acted on: on Configuration → Email / SMTP while the settings are incomplete, and above the access-request list, where it explains that nobody is getting a verification link and no request will reach you by email.",
+    ],
+    fixes: [
+      "On the sign-in card, Create an account / Forgot password / Didn't get the verification email are proper history steps now, so Back — including the mouse's back button — returns to the previous view. It used to move the address bar and leave the form on screen unchanged.",
+    ],
+    chores: [
+      "DELETE /api/admin/invites/{id}, refused with 409 while a User row exists for the address; the invite list carries has_account so the UI can withhold the affordance rather than offer a button that fails. Audited as invite_delete.",
+      "email._send() records an email_undelivered notification for every active admin on both the not-configured and the send-failed path, opening its own session and swallowing its own errors so the alert can never become a new way to break a send; /api/me carries email_configured for admins. The login card's mode moved to useHistorySubview, and the per-test rate-limiter reset now sweeps every loaded app.* module instead of a hand-kept list — this release added a limiter outside it.",
+    ],
+  },
   {
     version: "0.78.5",
     date: "2026-09-01",