Verify live mail + push delivery end-to-end with real providers

[suleimansh]

Part of #286 (dogfooding). Depends on the integrated reference app.

The Resend (mail) and Web Push/VAPID (push) transports are fully coded, but every test mocks the network. No email has provably reached an inbox and no push a real browser.

Close it:

• generate a VAPID keypair (npx web-push generate-vapid-keys)
• supply a real RESEND_API_KEY + a Resend-verified sender (the shared onboarding@resend.dev only reaches the account owner)
• send a real notification from the reference app, confirm the email lands and a push arrives in a browser
• write down the exact setup so it is repeatable

Until this passes, treat live delivery as unverified in any demo.