New

• api: wire scam classifier into /v1/emails pre-send path #439
• common: add scam_classifier module for pre-send phishing checks #438

Fixed

• api: deny-all CORS default and validate allow-list on startup #409 #436
• worker: distinguish daily status enqueued vs delivered #405