feat(emailing-domain): rate limits + per-recipient credit metering
Input caps:
- @MaxLength on subject/text/html, @ArrayMaxSize on to/cc/bcc/replyTo, and a
hard EMAIL_MAX_TOTAL_RECIPIENTS guard on the deliverable total (SES's
50-recipient limit).
Throttle:
- Reuse ThrottlerService token bucket keyed emailing-domain-send:<workspaceId>,
one token per deliverable recipient, checked before the driver send.
Credit metering (3x AWS cost; 1 credit = $1):
- New EMAIL_SEND UsageOperationType (+ exhaustive USAGE_UNIT map entry).
- Emit USAGE_RECORDED via the global WorkspaceEventEmitter, quantity = accepted
recipients, creditsUsedMicro = 0.0001 * 3 * DOLLAR_TO_CREDIT_MULTIPLIER per
recipient (300 micro/recipient). Enforcement rides the existing
USAGE_RECORDED -> ClickHouse -> cap pipeline, as WORKFLOW_EXECUTION does.
- Pre-send BillingUsageService.canFeatureBeUsed gate (rejects inactive plans;
permissive when billing disabled).
Order in sendEmail: verified -> tenant-status -> from-domain -> suppression
filter -> recipient cap -> billing gate -> throttle -> send -> meter.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
