feat(tier2): reminders + broadcasts pipeline — Block F

The Communications surface. Hosts can schedule custom broadcasts to a
chosen audience (everyone / attending / pending / declined / maybe),
edit or cancel anything that hasn't fired, and review delivery
outcomes. Four auto-reminders are pre-seeded on every new event:
7-day, 3-day last call, 1-day, and day-of.

Schema (migration 0012)
- scheduled_messages — one row per message envelope, with status
  walking draft -> scheduled -> sending -> sent (or cancelled/failed).
  Partial index on (send_at) WHERE status='scheduled' for the
  scheduler poll; per-event index for the Communications tab list.
- message_deliveries — per-recipient outcomes so a partial-failure
  batch doesn't lose the rows that did succeed.

Domain
- MessageAudience / MessageChannel / MessageStatus enums
- SeedAutoReminders helper that returns four canonical reminder rows
  for a given event_date, skipping any whose send_at would land in
  the past (events created close to the date)

Storage
- MessageRepo: Create / CreateBatch / Get / ListByEvent / Update
  (locks the row and refuses unless status is draft|scheduled) /
  Cancel / PromoteToScheduled (the send-now path) / ListDue /
  ClaimForSending (atomic guard against two replicas double-sending) /
  MarkSent / MarkFailed / RecordDelivery / DeliveryStats /
  LoadRecipients (audience-filtered guest list) / CountRecipients
- EventRepo.Create now seeds auto-reminders in the same transaction
  that inserts the event and its owner collaborator row

API (all editor+, except recipient-count which is viewer+)
- GET    /events/{id}/messages
- GET    /events/{id}/messages/recipient-count?audience=...
- POST   /events/{id}/messages   (draft / schedule / send-now)
- PATCH  /events/{id}/messages/{message_id}
- POST   /events/{id}/messages/{message_id}/send-now
- DELETE /events/{id}/messages/{message_id}

Scheduler worker (cmd/notifier)
- New file scheduler.go: polls ListDue every 30s, claims each row
  atomically (ClaimForSending uses a status=scheduled guard so two
  notifier replicas don't double-send), renders subject and body
  per recipient with the {{guest_name}} / {{event_name}} /
  {{event_date}} / {{venue}} / {{rsvp_link}} placeholders, sends via
  the existing GuestEmailDispatcher (Resend > SMTP > SES > log
  stub, same picker as the API), records each delivery row.

Frontend
- New CommunicationsCard.vue with compose form (audience + channel +
  subject + body + send-mode radios), live "X guests will receive
  this" recipient-count preview, and three sub-tabs for Scheduled /
  Sent / Cancelled. Per-message Send-now and Cancel actions for
  draft/scheduled rows. Friendly labels for auto-seeded reminders
  ("1-day reminder", "Day-of reminder") so the slugs never leak.
- New top-level tab "Communications" on the event-detail page,
  between Collaborators and Branding.

Tests
- TestAutoReminderSeeding confirms a future-dated event lands the
  four canonical reminders in scheduled state.
- TestComposeAndEditMessage walks draft -> patch -> send-now ->
  cancel and asserts the conflict on PATCH-after-cancel.
- TestRecipientCountAudienceFilter seeds a known guest mix and
  checks every audience preset returns the right count.
- Full integration suite passes (~177s).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/server.go

@@ -42,6 +42,7 @@ type Server struct {
 	branding  *brandingHandler
 	uploads   *uploadHandler
 	security  *securityHandler
+	messages  *messageHandler
 }
 
 type ServerDeps struct {
@@ -103,6 +104,7 @@ func NewServer(deps ServerDeps) (*Server, error) {
 	brandingRepo := storage.NewBrandingRepo(deps.DB)
 	allowlistRepo := storage.NewAllowlistRepo(deps.DB)
 	editNonces := newEditNonceStore(deps.Redis)
+	messageRepo := storage.NewMessageRepo(deps.DB)
 	feedbackRepo := storage.NewFeedbackRepo(deps.DB)
 
 	// Branding image store. Empty UploadsDir leaves it nil and the upload
@@ -275,6 +277,12 @@ func NewServer(deps ServerDeps) (*Server, error) {
 			feedback:  feedbackRepo,
 			access:    accessRepo,
 		},
+		messages: &messageHandler{
+			logger:  deps.Logger,
+			events:  eventRepo,
+			collabs: collabRepo,
+			repo:    messageRepo,
+		},
 		collabs: &collaboratorHandler{
 			logger:        deps.Logger,
 			events:        eventRepo,
@@ -391,6 +399,21 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("POST /events/{id}/access-logs/{log_id}/feedback",
 		authed(http.HandlerFunc(s.security.recordFeedback)))
 
+	// Block F — scheduled messages (reminders + broadcasts).
+	// All editor+ except the recipient-count preview which is viewer+.
+	mux.Handle("GET /events/{id}/messages",
+		authed(http.HandlerFunc(s.messages.list)))
+	mux.Handle("GET /events/{id}/messages/recipient-count",
+		authed(http.HandlerFunc(s.messages.recipientCount)))
+	mux.Handle("POST /events/{id}/messages",
+		authed(rl("messages_create", 100, 24*time.Hour, userIDKey, http.HandlerFunc(s.messages.create))))
+	mux.Handle("PATCH /events/{id}/messages/{message_id}",
+		authed(http.HandlerFunc(s.messages.update)))
+	mux.Handle("POST /events/{id}/messages/{message_id}/send-now",
+		authed(http.HandlerFunc(s.messages.sendNow)))
+	mux.Handle("DELETE /events/{id}/messages/{message_id}",
+		authed(http.HandlerFunc(s.messages.cancel)))
+
 	// Block D — event branding. Reads are viewer+; PUT is editor+. The
 	// upload endpoint is gated by auth only (any signed-in user can mint
 	// an image URL; the URL is no use without an event they can edit