feat(notify): add notif to internal users when granted

- add coalesced protection to avoid mail bombing if an invited goes many grant in a short period
    - add resentd method in share menu item (work for both internal and external users)
    - user can disable email notification via his properties
    - add env variable from admin to disable notifications

tests/api/external_users.hurl

@@ -63,11 +63,13 @@ Content-Type: application/json
 HTTP 201
 # The response carries the resolved subject as a regular user UUID —
 # externals never surface as a distinct subject_type post-PR-9.3a.
+# PR N1: POST /api/grants now wraps the array in
+# `CreateGrantResponseDto { grants, notification }`.
 [Asserts]
-jsonpath "$[0].subject.type" == "user"
-jsonpath "$[0].resource.id" == "{{ext_folder_id}}"
+jsonpath "$.grants[0].subject.type" == "user"
+jsonpath "$.grants[0].resource.id" == "{{ext_folder_id}}"
 [Captures]
-bob_user_id: jsonpath "$[0].subject.id"
+bob_user_id: jsonpath "$.grants[0].subject.id"
 
 
 # ─────────────────────────────────────────────────────────────
@@ -144,7 +146,7 @@ Content-Type: application/json
 
 HTTP 201
 [Asserts]
-jsonpath "$[0].subject.id" == "{{bob_user_id}}"
+jsonpath "$.grants[0].subject.id" == "{{bob_user_id}}"
 
 
 # ─────────────────────────────────────────────────────────────
@@ -447,7 +449,7 @@ Content-Type: application/json
 
 HTTP 201
 [Captures]
-rl_user_1_id: jsonpath "$[0].subject.id"
+rl_user_1_id: jsonpath "$.grants[0].subject.id"
 
 # 16b — 4th invite (4/3) is rejected with 429 + Retry-After. The
 #       cap is visible because Alice is authenticated and her own

tests/api/grants.hurl

@@ -122,9 +122,11 @@ Content-Type: application/json
 }
 
 HTTP 201
+# PR N1: POST /api/grants now wraps results in
+# `CreateGrantResponseDto { grants, notification }`.
 [Asserts]
-jsonpath "$" count == 1
-jsonpath "$[0].permission" == "read"
+jsonpath "$.grants" count == 1
+jsonpath "$.grants[0].permission" == "read"
 
 
 # ─────────────────────────────────────────────────────────────
@@ -205,7 +207,7 @@ Content-Type: application/json
 
 HTTP 201
 [Captures]
-eve_grant_id: jsonpath "$[0].id"
+eve_grant_id: jsonpath "$.grants[0].id"
 
 
 # ─────────────────────────────────────────────────────────────

tests/api/grants_nested_groups.hurl

@@ -281,11 +281,13 @@ Content-Type: application/json
 }
 
 HTTP 201
+# PR N1: POST /api/grants now wraps results in
+# `CreateGrantResponseDto { grants, notification }`.
 [Asserts]
-jsonpath "$" count == 1
-jsonpath "$[0].permission" == "read"
-jsonpath "$[0].subject.type" == "group"
-jsonpath "$[0].subject.id"   == "{{group_a_id}}"
+jsonpath "$.grants" count == 1
+jsonpath "$.grants[0].permission" == "read"
+jsonpath "$.grants[0].subject.type" == "group"
+jsonpath "$.grants[0].subject.id"   == "{{group_a_id}}"
 
 # ── Read endpoints now succeed ──────────────────────────────
 GET {{base_url}}/api/folders/{{perm_folder_id}}/resources?resource_types=folder