REVIEW-001 (M0) M2s: POST /access was a timing oracle — a hit did two
synchronous SMTP sends, a miss one SELECT, so "is this email on record?"
leaked (A3).
Dispatch the notification through a Deps.Dispatch seam (default `go fn()`),
detached from the request context (context.WithoutCancel, so audit values
survive) and bounded by a 30s timeout. Tests inject a synchronous runner
where they assert no-spam semantics, and a new test asserts the default is
asynchronous with a blocking mailer. A panic in the detached goroutine is
recovered: net/http no longer guards it, and a notification must never take
the process down.
Claus Lohmar
6f2ea67503