🐛 Fix boot recovery for pending newsletters

[fmercurio]

Internal validation only

This draft PR exists only to run the fork's CI and support an isolated, no-egress staging smoke for the exact candidate SHA below. It is not an upstream pull request and must not be merged into the fork's main branch as part of this validation.

Candidate

• Commit: e6915a2b66422fe03333e0573d173abd03fce980
• Base: Ghost v6.57.0 source base 3a4688313f857e96a4a940dc5288074978360ea9

Change

A narrowly bounded boot-time recovery path may requeue only recent, unmaterialized newsletters left pending before their in-memory batch job began. It preserves Ghost's existing transactional lock and never calls a provider directly.

Local evidence

• Focused email-service unit: 49 passing
• Database-backed recovery integration: 5 passing with in-process provider mocks
• Stub/transitional mailer unit: 27 passing
• Focused ESLint, dependency-boundary check, secret scan, and diff checks passed

Safety boundary

• No schema or migration changes
• No periodic scan, direct retry endpoint, or direct provider send
• Candidate recovery requires a positive audience, strict bounded creation time, empty error state, active/published relations, and zero batches/recipients
• Existing submitting recovery remains unchanged

No production, existing staging app, real SMTP/Mailgun provider, or recipient data is involved.