Harvest: shared SaaS ops kernel

Summary

Tenancy (v1.0) stays as-is. This release adds the Harvest ops kernel: shared mail, notify primitives, audit, platform MFA, Attention, and i18n overlays — proven in product use, now in the pack so every SaaS app gets the same factory pieces without domain coupling.

What's new

• Mail — MailGateway + SecretBox (platform / plan-gated tenant SMTP, .env fallback, email_log)
• Notify — empty NotifyRegistry (apps register types), NotifyGate pause, Notify fire + mutes
• Audit — append-only AuditLog with impersonator support
• MFA — Totp (RFC 6238) for platform admins
• Ops — Attention, PlatformSettings, SchedulerHeartbeat
• i18n — Catalog (file + DB overlays) + thin PlatformOps / I18n APIs
• Migration — 002_saas_ops_layer.sql
• Docs — docs/09-harvest-ops.md

Continuity

• Dual-unseal — seal() writes pack peppers only; unseal() still reads myCMMS legacy peppers (|smtp-password-v1, mycmms-totp|) so path upgrades do not brick existing SMTP/MFA rows
• Harvest kernel classes are not final — products may thin-extend

Deliberately out of this release

Domain notify catalogs, payments/billing, full PlatformAdmin UI tabs, AI translate

Requires

• PHP >= 8.1
• bitshost/upmvc ^2.4
• phpmailer/phpmailer ^6.9

Upgrade

1. composer require bitshost/upmvc-saas-pack:^1.1
2. Ensure packages.php registers BitsHost\UpmvcSaas\SaasServiceProvider
3. Run migrations (applies 002_saas_ops_layer.sql)
4. Register product notify types into NotifyRegistry at boot (pack registry stays empty)

Full notes: CHANGELOG.md · wiring: docs/09-harvest-ops.md