Administrative email authorization

The three administrative send actions under /api/admin-email require ApplicationSendEmailPolicy: send-templated-email, send-bulk-templated-email, and send-templated-email-to-all-active-investigators. Previously these actions required sign-in only, allowing an ordinary authenticated caller to trigger sends.

The new SendEmail application permission defaults to the exact lowercase administrator application group, matching the existing email-template permissions. The existing API authorization handler evaluates this permission using request application-group claims plus stored Investigator application-role names. Project membership, ownership and project Administrator groups do not grant this system-wide capability. Existing group-name matching remains case-sensitive; this change does not introduce aliases or alter identity claims.

No syrfOwnedApplicationRoles* mode removes this gate. In off and shadow mode the claim-based administrator check decides, as above. Since M2a (#3867), enforced mode decides the same Administrator requirement from current PM authority, as it does for every other application capability: the old claim alone then grants nothing, and an authority outage answers 503. Tests cover all three modes.

Anonymous requests return 401; authenticated callers lacking the permission return 403 before sending mail or enumerating active recipients. Authorized callers retain the existing send behavior. Template listing and editing retain their separate permissions. The permission is registered by the existing application-policy registration loop; no separate host registration is needed.

Validation and rollout

AdminEmailAuthorizationTests uses actual MVC routes, the global authentication filter, the production authorization handler, and the shipped permission defaults. It checks all three actions for anonymous, ordinary and near-match group callers, asserts no email or recipient-list calls on denial, and exercises authorized sends using fake email delivery. No external email is sent by the tests.

This security correction is unflagged: a runtime switch must not restore the missing authorization check. It requires no data migration or provider cutover. Deploy with the normal API release process; no deployment is performed by this PR. Clients relying on ordinary users calling these administrative routes will receive 403 and must use an authorized application administrator.

This is the first bounded implementation slice of #3335. The broader effective-authority service, stage membership semantics, role normalization and allocation integration remain separate work. This change does not close the evaluation issue or #3251.