qm init: pick one email transport and scaffold only its keys

[ReganBell]

A real deployment was confused by qm init scaffolding both transports at once: .env.example offered RESEND_API_KEY and SMTP_HOST/SMTP_USERNAME/SMTP_PASSWORD while the config silently defaulted to resend, so operators filled in the wrong set and only found out when sign-in emails never arrived.

qm init now takes --email-transport resend|smtp (default resend, matching the previous scaffold), mirroring the existing --model-provider flag pattern:

• the scaffolded config's env.auth.AUTH_EMAIL_TRANSPORT is set to the chosen transport (fly and aws scaffolds; docker has no auth service)
• renderEnvExample drops catalog entries gated on the other AUTH_EMAIL_TRANSPORT value, so the scaffolded .env and .env.example contain only the chosen transport's keys — the chosen transport's keys appear uncommented and required
• AUTH_EMAIL_TRANSPORT validation and the flag share one EMAIL_TRANSPORTS definition in config.ts

Tests: new init case asserting --email-transport smtp writes a matching config with SMTP_* required and no RESEND_API_KEY anywhere in .env/.env.example, plus assertions that the default resend scaffold contains no SMTP_* keys. npm run typecheck, eslint, and oxlint clean; init/secrets/config/cli-dispatch/providers/auth-broker/setup suites pass (127/127).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}