chore(#149): pin published @rafters/mail* at ^0.1.0, drop ../mail workspace links

[ssilvius]

Summary

Executes platform's half of the mail workspace-seam ruling (mail board post 019fcde5-a07f): the six ../mail/packages/* sibling entries in pnpm-workspace.yaml were a cross-repo re-link contamination hazard -- mail confirmed exactly these six packages had per-package node_modules symlinked into platform against mail's own dependency resolutions. All six are published on npm at 0.1.0, so platform now consumes them as ordinary registry dependencies pinned ^0.1.0 (pre-1.0 caret keeps us on 0.1.x patches; mail will signal minors that matter). Same doctrine as rafters #144: accepted version lag beats cross-repo re-link contamination.

Acceptance criteria mapping

1. pnpm-workspace.yaml no longer lists any ../mail/packages/* entry

The packages list drops the six ../mail/packages/* lines (core, resend, react-email, better-auth-resend, cloudflare, drizzle), leaving apps/* and the three ../rafters/packages/* entries untouched -- the rafters seam has its own ruling and is explicitly out of scope here. With the entries gone, pnpm can no longer resolve any @rafters/mail* name as a workspace project, which is what forces registry resolution everywhere downstream.
Evidence: pnpm-workspace.yaml:1-5 (packages list is now apps/* plus the three rafters entries only)

2. apps/web pins all six packages at ^0.1.0 instead of workspace:*

All six dependency specs in apps/web -- @rafters/mail, mail-resend, mail-cloudflare, mail-drizzle, mail-react-email, better-auth-resend -- move from workspace:* to ^0.1.0, matching the shape of the pre-existing @rafters/ledger: ^0.2.0 pin. The root package.json's devDependency on @rafters/better-auth-resend (used by the root vitest setup) needed the same swap, since a workspace:* spec anywhere fails resolution once the workspace entries are gone -- pnpm install errored on exactly that until it was pinned too.
Evidence: apps/web/package.json:17-24 and package.json:19

3. apps/inbox pins mail-cloudflare and mail-drizzle at ^0.1.0

The two specs in apps/inbox move from workspace:* to ^0.1.0; inbox depends on nothing else from the mail family, so nothing else changed there.
Evidence: apps/inbox/package.json:10-11

4. pnpm install resolves the six from the npm registry

Removed the stale symlinks pointing into ../mail (root node_modules/@rafters/better-auth-resend plus the per-app @rafters/mail* links -- the directory removal is load-bearing, same as mail's own decontamination) and re-ran pnpm install. The lockfile collapsed 1403 lines of link-protocol importer subtrees into registry entries, and readlink on every @rafters/mail* path now resolves into platform's own .pnpm store at 0.1.0; pnpm why @rafters/mail shows exactly one registry-resolved version. The remaining out-of-repo links are the three rafters packages, by design.
Evidence: pnpm-lock.yaml:248 ('@rafters/mail': ^0.1.0 importer spec) and node_modules/.pnpm/@Rafters+mail@0.1.0

5. pnpm -r typecheck and builds are green

pnpm -r typecheck passes across all six projects with typecheck scripts (web, inbox, and the rafters workspace packages), both worker builds succeed (wrangler deploy --dry-run for web at 209 KiB and inbox), and the full pre-commit pipeline (oxlint, oxfmt, tsc, vitest: 40 passed / 5 skipped) ran green on the commit.
Evidence: pre-commit hook output on 4a4e968 -- lint, format, typecheck, test all green

Not done

The three ../rafters/packages/* workspace entries (color-utils, shared, math-utils) still link cross-repo; that seam is governed separately and is not part of this issue. Also left the @rafters/ledger pin at ^0.2.0 -- the ledger 0.3.0 adoption is a separate decision with its own migration notes.

Closes #149