Add root-team-authorized API access for SMTP and Resend settings with validation, sensitive-field controls, auditing, and coverage.