chore: migrate mail themes to shared framework and locked upstream inputs

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,7 @@
+# Third-Party Notices
+
+Official mail templates, locale JSON catalogs, the preview favicon and reviewed implementation references originate from [Gitea](https://github.com/go-gitea/gitea). The tool downloads them to ignored `build/upstream/`; only the generated tag, commit and file SHA-256 lock (`gitea.lock.json`) is kept in source control.
+
+Gitea is licensed under MIT. Its unmodified license is downloaded as `build/upstream/LICENSE`. Release archives retain it as `GITEA-LICENSE` and include `upstream-lock.json` as provenance for generated templates and translated previews. Deployment mail logos reference the instance asset URL; only generated preview data embeds the official icon for offline display.
+
+Theme presentation and tooling are covered by this repository's [MIT license](LICENSE). Go module dependencies and their versions are recorded in `tools/go.mod` and `tools/go.sum`.