chore(broadcast): wire mana-mail into env pipeline + push schema

The three final pre-dogfood items:

1. drizzle.config: schemaFilter now includes 'broadcast' alongside
   'mail'. Without this, `bun run db:push` skipped the broadcast
   tables — schema existed in code but not in Postgres. Tested via
   db:push + psql \dt (3 tables created: campaigns, events, sends).

2. .env.development: new MANA-MAIL SERVICE section with Stalwart
   knobs + broadcast config (tracking secret, rate limits, send
   throttle). DEV secret is explicitly labelled non-production —
   prod rotates via env.

3. generate-env.mjs: new block writes services/mana-mail/.env on
   `pnpm setup:env`. Mirrors the invoices / research / events
   pattern. All 16 broadcast/mail vars flow through from SSOT.

Verified end-to-end:
- pnpm setup:env → services/mana-mail/.env contains
  BROADCAST_TRACKING_SECRET + rate limits
- bun run src/index.ts → /health returns 200 with the new config
- psql → broadcast.campaigns / events / sends are materialised

Broadcast module is now fully ready to send real mail — nothing
else required before the first dogfood campaign.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.development

@@ -509,3 +509,35 @@ GPU_SERVER_LAN_URL=http://192.168.178.11
 
 # Vision Model for Food + Planta (local, replaces Google Gemini)
 VISION_MODEL=ollama/gemma3:12b
+
+# ============================================
+# MANA-MAIL SERVICE (Port 3042)
+# ============================================
+# Stalwart + Broadcast (Newsletter) config. Stalwart settings come from
+# the Stalwart admin panel; these are the Mana-side knobs.
+
+# mana-mail DB uses mana_platform (shared). Dev fallback in code is fine;
+# override here for staging/prod.
+MANA_MAIL_DATABASE_URL=postgresql://mana:devpassword@localhost:5432/mana_platform
+
+# Stalwart JMAP/admin — align with your local Stalwart container
+STALWART_JMAP_URL=http://localhost:8080
+STALWART_ADMIN_USER=admin
+STALWART_ADMIN_PASSWORD=ChangeMe123!
+MAIL_DOMAIN=mana.how
+
+# ─── Broadcast (Newsletter) ────────────────────────────────
+# HMAC secret for tracking-token signing. Tokens appear in public URLs
+# (open pixel, click redirect, unsubscribe link). CHANGE IN PROD.
+# Use `openssl rand -hex 32` or similar for a real secret.
+BROADCAST_TRACKING_SECRET=dev-broadcast-tracking-secret-NOT-for-prod
+
+# How many recipients a single campaign may have. Hard cap.
+BROADCAST_MAX_RECIPIENTS_PER_CAMPAIGN=5000
+
+# Per-user rate limit — not currently enforced, reserved for M-Phase2.
+BROADCAST_MAX_RECIPIENTS_PER_HOUR=500
+
+# Milliseconds to sleep between JMAP submits during bulk-send.
+# 150ms ≈ 6/sec ≈ 360/min. Protects Stalwart + downstream relays.
+BROADCAST_SEND_THROTTLE_MS=150