fix(mail): log rate-limit rejections, campus-safe code limit, multipart From name, 스팸함 안내

[choijunhuk]

Summary

Members reported verification emails "not arriving." Investigation found: SMTP sends succeed and are logged; two Gmail recipients requested codes but never entered one (likely spam/promotions); 429 rate-limit rejections are never logged so they're indistinguishable from real delivery failures; and the per-IP email-code limit (5 per 10 min) is easily tripped by a campus NAT.

Four bounded, independently-reviewable commits:

1. Diagnostics — AuthService logs a WARN at each TOO_MANY_REQUESTS throw site with the limiter name and a masked client key (IP -> first two octets + x.x; studentId -> first 4 chars + ***). EmailVerificationSender logs the effective SMTP host/port and a masked username once at startup, so a misconfigured deploy is visible.
2. Campus NAT — MAX_SIGNUP_EMAIL_REQUESTS_PER_WINDOW raised 5 -> 20 per 10 min per IP; the per-account 1-minute cooldown is unchanged and remains the real anti-spam guard. No existing test pinned the old value of 5, so this adds direct coverage of the new cap.
3. Deliverability — verification/reset mail is now sent as multipart text+HTML via MimeMessageHelper, with a KW COM's display name on the From address, a matching Reply-To, and the code included in the subject ([KW COM's] 이메일 인증코드 123456). HTML is minimal: no images, no links besides the site root. MAIL_ENABLED=false still falls back to the existing log-only path.
4. Web UX — both the signup email-verification step and the password-reset step now show a hint under the code input ("메일이 오지 않으면 스팸함·프로모션함을 확인해주세요. 1분 후 다시 요청할 수 있습니다."). Both already had a resend button that surfaces the backend's exact message (including the 429 cooldown text) via the shared apiClient error path.

Test plan

• ./gradlew test — BUILD SUCCESSFUL (full suite, incl. new EmailVerificationSenderTest and the new signup-email rate-limit test)
• npm test — typecheck, lint, and all 26 contract tests pass
• Manual: sign up on a shared/campus IP with several accounts in a row and confirm codes still send under the raised cap
• Manual: verify the multipart email renders correctly (From display name, HTML body) in Gmail

🤖 Generated with Claude Code