Missing structured outbound TLS metrics

[mohamedboukari]

Description

Can't tell from logs whether a delivery used TLS, what cipher, or whether the cert validated.

Ref: src/modules/emails/services/mailer.service.ts:100 — transport.sendMail(mailOptions) returns no TLS info to the caller.

Acceptance criteria

• Log tls: { used, version, cipher, validated } on every outbound send
• Surface aggregated TLS rate on the dashboard (% delivered with TLS)
• Optionally expose via /api/v1/stats endpoint

[mohamedboukari]

Deferring to #60. Capturing TLS state per-send needs either a custom Nodemailer transport (fragile, reaches into private APIs) or a Bun-native SMTP client we can read the underlying TLSSocket from directly. The native-client path is cleaner and unblocks #42 + part of #56 in the same swing — see #60 for scope and phasing.