Send sign-in mail as HTML so quoted-printable wrapping cannot break the verify URL.

Staging was delivering magic links that looked expired because the token query string was encoded and wrapped in plaintext MIME. Also read rate-limit retry from the API error body, mention spam in the success copy, and document SES relay DNS.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/components/LoginForm.test.tsx

@@ -125,6 +125,7 @@ describe("LoginForm", () => {
       await screen.findByRole("heading", { name: /check your email/i }),
     ).toBeInTheDocument();
     expect(screen.getByText(/we sent a sign-in link/i)).toBeInTheDocument();
+    expect(screen.getByText(/check spam or promotions/i)).toBeInTheDocument();
   });
 
   it("submits a long email without treating length as invalid", async () => {