feat: add Resend email + encryption key + initial user to provision flow

- RESEND_API_KEY added to config (required env var)
- Provision generates per-customer ENCRYPTION_KEY and patches lunarfront-secrets with resend-api-key, mail-from, business-name, encryption-key
- initialEmail field in ProvisionSchema seeds first admin user via env vars on app first boot

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/config.ts

@@ -15,6 +15,7 @@ export const config = {
   cfApiToken: process.env.CF_API_TOKEN!,
   cfZoneId: process.env.CF_ZONE_ID!,
   ingressIp: process.env.INGRESS_IP ?? "167.99.21.170",
+  resendApiKey: process.env.RESEND_API_KEY!,
 };
 
 for (const [key, val] of Object.entries(config)) {

src/routes/customers.ts

@@ -24,6 +24,12 @@ const ProvisionSchema = z.object({
   modules: z.array(z.enum(MODULES)).default([]),
   startDate: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).default(() => new Date().toISOString().slice(0, 10)),
   expirationDate: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).nullable().default(null),
+  initialEmail: z.object({
+    email: z.string().email(),
+    password: z.string().min(12).max(128),
+    firstName: z.string().min(1).max(100),
+    lastName: z.string().min(1).max(100),
+  }).optional(),
 });
 
 const ListQuerySchema = z.object({
@@ -128,12 +134,23 @@ export async function customerRoutes(app: FastifyInstance) {
       await setStep("namespace", "done");
       await setStep("secrets", "done");
 
+      const encryptionKey = crypto.randomBytes(32).toString("hex");
       await patchSecret(namespace, "lunarfront-secrets", {
         "spaces-key": config.spacesKey,
         "spaces-secret": config.spacesSecret,
         "spaces-bucket": config.spacesBucket,
         "spaces-endpoint": `https://${config.spacesRegion}.digitaloceanspaces.com`,
         "spaces-prefix": `${slug}/`,
+        "encryption-key": encryptionKey,
+        "resend-api-key": config.resendApiKey,
+        "mail-from": `noreply@${slug}.lunarfront.tech`,
+        "business-name": body.name,
+        ...(body.initialEmail ? {
+          "initial-user-email": body.initialEmail.email,
+          "initial-user-password": body.initialEmail.password,
+          "initial-user-first-name": body.initialEmail.firstName,
+          "initial-user-last-name": body.initialEmail.lastName,
+        } : {}),
       });
       await setStep("storage", "done");