[vicdenz]

Scope

• Enable the optimized production Cognito pool to send confirmation and recovery codes through the verified tryindus.ca SES identity.
• Look up the existing public hosted zone, publish SES ownership, DKIM, monitoring-only DMARC, and aligned MAIL FROM records, and retain the Indus code-entry template.
• Grant the optimized Terraform role the required SES identity and Cognito email service-role permissions.
• Add a reviewed prepare-email rollout stage that verifies the domain and DNS while Cognito retains its default sender. Refuse the sender switch until SES production access, DKIM, and MAIL FROM are verified. Keep the default-sender rollback path available.

Verification

• terraform fmt -check -recursive infra/optimized/terraform
• terraform validate in both optimized Terraform roots
• terraform test in the optimized environment root (5 passed)
• actionlint
• node --test scripts/capacity/*.test.mjs (11 passed)
• bash scripts/optimized/validate-isolation.sh
• docker compose --env-file infra/optimized/runtime/release.env.example -f infra/optimized/runtime/compose.yaml config
• bash -n scripts/optimized/install-release.sh infra/optimized/runtime/bootstrap.sh
• git diff --check

No local E2E was run, as requested. The Caddy container validation from optimized verification could not run because the local Docker daemon is unavailable. Bootstrap provider installation ran out of disk space; validation passed using the already downloaded provider from the environment root.

The PR's optimized infrastructure and AWS platform jobs passed. The unrelated core application job fails its legacy Next.js dependency audit on two moderate advisories.

Deployment and migration impact

No database migration. This PR does not apply infrastructure. AWS requested further information and a verified SES identity for production access; aws-alerts@tryindus.ca has been verified as a temporary account prerequisite. Before rollout, update the optimized bootstrap Terraform role, run prepare-email, and confirm the domain authentication and SES production access in us-east-1. Both rollout stages require a reviewed saved plan and production approval. The switch changes the sender for signup confirmation and password recovery; existing users are unchanged.

Rollback

Set enable_branded_cognito_email = false in production-email.auto.tfvars, review the plan, and apply through the optimized infrastructure workflow. Cognito returns to its default sender. The SES production-access guard only applies to plans that keep the SES sender enabled.

Deferred work

• Reply to AWS support case 179218787600419 with the requested sending details, confirm SES production access, and deploy after approval. Verify live mailbox authentication, delivery, and spam placement.
• Delete the temporary aws-alerts@tryindus.ca SES email identity after the domain identity is verified and production access is approved.
• The separate signup error-recovery work remains outside this infrastructure PR.