Add transactional emails (SMTP) and planner features (no-go areas, notes, crash recovery)

Transactional emails:
- Add nodemailer SMTP email module with dev-mode console logging
- Magic link template and welcome template with HTML + plain text
- Wire sendMagicLink into login flow, sendWelcome into registration
- Update privacy page and deploy docs for SMTP configuration

Planner features:
- No-go areas: draw polygons on map (leaflet-geoman), synced via Yjs,
  passed to BRouter as nogos parameter, route recomputes on change
- Session notes: collaborative Y.Text textarea in sidebar tab
- Crash recovery: periodic localStorage save of Yjs state, restore on reconnect
- Rate limit session creation (10/IP/hour) in /new route

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/planner/app/lib/brouter.ts

@@ -1,10 +1,15 @@
 const BROUTER_URL = process.env.BROUTER_URL ?? "http://localhost:17777";
 
+export interface NoGoArea {
+  points: Array<{ lat: number; lon: number }>;
+}
+
 export interface RouteRequest {
   waypoints: Array<{ lat: number; lon: number }>;
   profile?: string;
   alternativeIdx?: number;
   format?: string;
+  noGoAreas?: NoGoArea[];
 }
 
 /**
@@ -20,6 +25,11 @@ export async function computeRoute(request: RouteRequest): Promise<unknown> {
   const profile = request.profile ?? "trekking";
   const format = request.format ?? "geojson";
 
+  // Build no-go parameter if areas exist
+  const nogoParam = request.noGoAreas?.length
+    ? noGoAreasToParam(request.noGoAreas)
+    : undefined;
+
   // Route each segment independently
   const segments = await Promise.all(
     request.waypoints.slice(0, -1).map((wp, i) => {
@@ -31,6 +41,7 @@ export async function computeRoute(request: RouteRequest): Promise<unknown> {
         alternativeidx: "0",
         format,
       });
+      if (nogoParam) params.set("nogos", nogoParam);
       return fetchSegment(`${BROUTER_URL}/brouter?${params}`);
     }),
   );
@@ -104,6 +115,41 @@ function mergeGeoJsonSegments(segments: Record<string, unknown>[]): GeoJsonColle
   };
 }
 
+/**
+ * Convert no-go area polygons to BRouter's `nogos` parameter format.
+ * BRouter accepts `lon,lat,radius` per no-go circle, separated by `|`.
+ * We approximate each polygon as a circle: centroid + max distance to any vertex.
+ */
+function noGoAreasToParam(areas: NoGoArea[]): string {
+  return areas
+    .map((area) => {
+      const pts = area.points;
+      if (pts.length === 0) return null;
+      // Centroid
+      const cLat = pts.reduce((s, p) => s + p.lat, 0) / pts.length;
+      const cLon = pts.reduce((s, p) => s + p.lon, 0) / pts.length;
+      // Max distance from centroid in meters (approximate)
+      const maxDist = Math.max(
+        ...pts.map((p) => haversineMeters(cLat, cLon, p.lat, p.lon)),
+      );
+      return `${cLon},${cLat},${Math.ceil(maxDist)}`;
+    })
+    .filter(Boolean)
+    .join("|");
+}
+
+function haversineMeters(lat1: number, lon1: number, lat2: number, lon2: number): number {
+  const R = 6371000;
+  const dLat = ((lat2 - lat1) * Math.PI) / 180;
+  const dLon = ((lon2 - lon1) * Math.PI) / 180;
+  const a =
+    Math.sin(dLat / 2) ** 2 +
+    Math.cos((lat1 * Math.PI) / 180) *
+      Math.cos((lat2 * Math.PI) / 180) *
+      Math.sin(dLon / 2) ** 2;
+  return R * 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
+}
+
 export function getBRouterUrl(): string {
   return BROUTER_URL;
 }