One-click Amazon SES connect via CloudFormation cross-account role (optional, provider-agnostic) #80

Background

Amazon SES is the cheapest provider and the one beehiiv switchers are being pointed to (MailCheap, SendBunny, "Sendy + SES" replies on x.com/wickedguro/status/2111362653004140600). It is also the hardest to set up: IAM user and access keys, domain verification and DKIM CNAMEs, an SNS topic for bounces and complaints (needed by #58), a configuration set, and the sandbox/production access request. Today a SendLit user must do all of that by hand and paste access keys.

AWS has no OAuth, but the standard SaaS pattern (Datadog, SendBunny) is a CloudFormation quick-create link that creates a cross-account IAM role in the customer's account.

This is an optional shortcut for SES only. SendLit stays provider-agnostic: Mailgun, SendGrid, Postmark, Resend and SMTP keep connecting with API keys as today, and the sending/adapter code does not change.

Proposed fix

1. "Connect AWS in one click" button in the ESP settings, shown next to the existing SES access-key option.
2. It opens a CloudFormation quick-create URL with a SendLit-hosted template and parameters pre-filled (team id, per-team ExternalId, SendLit's AWS account id, region).
3. The stack creates an IAM role trusting SendLit's AWS account with sts:ExternalId condition (confused-deputy protection), scoped to least privilege: SES v2 identities/config sets/sending/account details, SNS topic + subscription for SendLit's webhook, and optional Route 53 record changes limited to the chosen hosted zone.
4. A custom-resource/Lambda callback posts the role ARN back to SendLit (signed, tied to the team), so the user pastes nothing.
5. SendLit assumes the role via STS for short-lived credentials; no long-lived AWS keys are stored.
6. Automated setup once connected:
   • create the domain identity and fetch DKIM tokens;
   • if the domain is in Route 53, create DKIM, SPF/MAIL FROM and DMARC records; otherwise show copy-ready records (Built-in DKIM/SPF/DMARC guidance #4);
   • create a configuration set and SNS topic and subscribe SendLit's bounce/complaint endpoint (feat: ingest Amazon SES bounces and complaints via SNS #58);
   • read account sending quota and max send rate and feed them into send-rate limits (Per-ESP send-rate limiting (e.g. SES max send rate) #51) and warm-up caps (Day-one warm-up answer: warm-up guide and self-serve daily send caps for new domains / SES accounts #67);
   • offer to submit the production access request via PutAccountDetails with prefilled use-case text.
7. "Disconnect" deletes the role reference; docs explain deleting the stack.

Acceptance criteria

• A team can connect SES via the CloudFormation link without creating access keys
• Role trust policy requires a unique per-team ExternalId; permissions are least-privilege and documented
• Role ARN is returned automatically and verified before saving
• Domain identity, DKIM, configuration set and SNS bounce/complaint subscription are created automatically
• Route 53 domains get DNS records created automatically; non-Route 53 domains get copy-ready records
• Sending quota and max send rate are read and applied to throttling
• Production access request can be submitted from SendLit
• Existing access-key SES connection and all other ESPs keep working unchanged
• Template is versioned and published in the repo; docs page added

Related: #79, #51, #58, #67, #4, #28