Sync docs, audit artifacts, project notes, and VerdictTank proposal docs

- audit/phase-one + phase-two: security audit briefs, findings, credential-rotation plan, Docker-USER hardening scripts, rollback refs
- disaster-recovery/restore-test-log.md + backup-dr-audit-2026-08-10.md
- clients/ (modelortho SEO audit, ai-biz-dev competitive landscape), notes/ (tiktok strategy)
- projects/: front-desk-voice-agent, seo-visibility-checker product plan, hotnow-savannah HTML, resend-transactional-email, backup-dashboard-enhancements, code-review-graph, seo-ci-architecture
- proposals/verdicttank/: architecture v4.0, methodology, judge-pool review, consolidation reasoning, cross-check review
- docs/super-search/firecrawl-provider-strategy.md
- updates: CHANGELOG, model-chain, projects-master-readme, intelsight.io
- .gitignore: exclude nested standalone repos (seo-tool, venturebuilt)

projects/resend-transactional-email.md

@@ -0,0 +1,69 @@
+# Resend — Transactional Email Platform (Future Project)
+
+**Status:** PLACEHOLDER — not_started
+**Prepared for:** Germaine Brown / IT Pro Partner
+**Date:** August 14, 2026
+**Trigger:** Projects that email END USERS (confirmations, receipts, notifications) need per-domain `From:` with SPF/DKIM. The shared relay (SiteGround / MXroute) can only send as its own hosted domains — it can't send "as" arbitrary client domains.
+
+---
+
+## Why this exists (and what it is NOT)
+
+Two distinct email needs, don't conflate them:
+
+| Need | Recipient | Correct pattern | Status |
+|---|---|---|---|
+| Contact-form notification | Site owner | One trusted sender + per-domain routing + Reply-To | ✅ MSP Form Handler already does this |
+| End-user email (confirm/receipt) | The submitter / customer | **Per-domain `From`** with SPF/DKIM | ❌ Needs Resend |
+
+The MSP Form Handler (`forms.itpropartner.com`) notifies **site owners** only — `noreply@itpropartner.com`, per-domain recipient mapping in `config/domains.yaml`, Reply-To = submitter. That is the correct architecture and does not change.
+
+But some projects email **end users** directly — WordPress contact-form auto-replies, appointment confirmations, receipts, welcome emails. Those should come **from the client's own domain** (`hello@client.com`) so they pass SPF/DKIM and avoid spam. The shared relay can't do that. **Resend can.**
+
+## Which projects need it
+
+- Current WordPress sites that send confirmation/auto-reply email to end users (enumerate at activation).
+- Future projects with receipts / confirmations / notifications.
+- MSP Form Handler — only if/when it gains submitter auto-acknowledgements.
+
+## What Resend gives us
+
+- **Per-domain verification:** add SPF + DKIM (optional DMARC) to each client domain, then send "as" that domain.
+- **One account, many domains**, domain-scoped API keys.
+- Dedicated IP reputation + bounce/complaint tracking — better deliverability than a shared-hosting relay.
+- **SMTP + REST API.** WordPress via WP Mail SMTP / FluentSMTP or a lightweight Resend plugin; custom apps via the REST API.
+
+## Cost (verify current pricing at activation)
+
+- Free: ~3,000 emails/mo, 100/day, single domain.
+- Pro: ~$20/mo — ~50k/mo, unlimited domains, dedicated IP add-on.
+- For multi-client domain needs, Pro (unlimited domains) is the likely tier.
+
+## Architecture (planned)
+
+- One Resend account under `g@germainebrown.com`.
+- Per client needing it: verify their domain (SPF + DKIM in their DNS — we control most via Cloudflare), create a domain-scoped API key.
+- WordPress: WP Mail SMTP pointed at Resend with the client's domain as sender.
+- Custom apps (FastAPI / Node): Resend REST API, per-domain sender.
+- API keys live in Vaultwarden — never in plaintext or committed config.
+
+## Activation checklist
+
+- [ ] Create Resend account.
+- [ ] Decide Free vs Pro (Pro for unlimited domains).
+- [ ] Verify first client domain (SPF + DKIM records).
+- [ ] Wire first project (WordPress plugin or API).
+- [ ] Set DMARC on sending domains (`p=none` → `quarantine` as volume grows).
+- [ ] Store API key in Vaultwarden.
+- [ ] Add to backup/DR inventory if it becomes critical path.
+
+## Decision points (open)
+
+- Resend vs AWS SES vs Postmark (Resend = default pick; simplest DX, cheap).
+- Single account with per-domain keys vs per-client accounts.
+- Sending subdomain convention: `mail.client.com` (recommended) vs apex `client.com` — subdomain keeps SPF/DKIM/DMARC clean and isolated.
+
+## Related
+
+- `smtp-relay-configuration` skill — netcup outbound only allows 2525; shared relay rejects non-hosted MAIL FROM.
+- MSP Form Handler lives at `/var/www/msp-forms` on app3 (FastAPI, `config/domains.yaml`, `config/settings.yaml`).