Add Resend API key to admin-configurable Server secrets

Was only ever settable via .env - now follows the same pattern as
Cloudflare Turnstile: SystemSecretKey.RESEND_API_KEY + a META entry
covers storage/encryption/frontend rendering automatically (the
Settings UI's Server secrets box is fully data-driven off this list).
Wired the register/login/resend-verification/request-password-reset
route handlers to use get_effective_settings so an admin-set key
actually reaches the emails those flows send, not just .env's value.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/api/tests/unit/test_system_secrets.py

@@ -94,10 +94,14 @@ async def test_repository_upsert_then_get_then_delete(db_session):
 # --- Service -------------------------------------------------------------
 
 
-async def test_list_status_shows_both_keys_unconfigured_by_default(db_session):
+async def test_list_status_shows_all_keys_unconfigured_by_default(db_session):
     settings = get_settings()
     statuses = await system_secret_service.list_status(db_session, settings)
-    assert {s["key"] for s in statuses} == {"turnstile_site_key", "turnstile_secret"}
+    assert {s["key"] for s in statuses} == {
+        "turnstile_site_key",
+        "turnstile_secret",
+        "resend_api_key",
+    }
     assert all(s["configured"] is False for s in statuses)
     assert all(s["value"] is None for s in statuses)
 
@@ -165,6 +169,20 @@ async def test_get_effective_settings_overrides_only_the_keys_that_were_set(db_s
     assert effective.turnstile_secret == "global-secret"  # untouched, no override set
 
 
+async def test_admin_configured_resend_key_overrides_the_env_value(db_session):
+    settings = get_settings().model_copy(update={"resend_api_key": "global-resend-key"})
+    await system_secret_service.set_secret(
+        db_session,
+        SystemSecretKey.RESEND_API_KEY,
+        "admin-resend-key",
+        settings,
+        admin_user_id=uuid.uuid4(),
+        client_ip="10.0.0.1",
+    )
+    effective = await system_secret_service.get_effective_settings(db_session, settings)
+    assert effective.resend_api_key == "admin-resend-key"
+
+
 # --- Endpoints -----------------------------------------------------------