feat(intake): add the submission notification template (#224)

Editable from the settings screen like every other template. reviewUrl is the only required placeholder: a notification with no link in it still sends, still looks fine in the log, and is useless to whoever receives it, which is what the required-placeholder validation exists to catch.

The two signed links are deliberately optional. They are absent whenever INTAKE_ACTION_SECRET is unset, and a template demanding them would leave an unconfigured environment unable to send this at all.

A test asserts the template offers no way to publish. That the email cannot publish is what bounds the risk taken by pricing items on arrival, and it is a property of the copy as much as of the routes — a publish link in the body would be one nobody reviewed.

Where the notification goes is an admin setting rather than an environment variable, for the same reason drafting_model is one: it is changed by whoever runs the shop, not by whoever deploys it. Empty is the default and means do not notify, which is a working configuration.

INTAKE_ACTION_SECRET warns rather than fails at boot, like the drafting key. Being told an item arrived matters far more than being able to discard it in one click.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/adminSettings.ts

@@ -34,7 +34,13 @@ const DEFINITIONS = [
     name: 'draftingModel',
     type: 'choice',
     fallback: DEFAULT_DRAFTING_MODEL
-  }
+  },
+  // Where the intake notification goes (#224). A setting rather than an
+  // environment variable, for the same reason drafting_model is one: it is
+  // changed by whoever runs the shop, not by whoever deploys it, and a redeploy
+  // to change an address would be absurd. Empty means do not notify, which is
+  // the default and a working configuration.
+  { key: 'intake_notify_email', name: 'intakeNotifyEmail', type: 'text', fallback: '' }
 ] as const;
 
 type Definition = (typeof DEFINITIONS)[number];