Add cache-bust endpoint — invalidates workforce + smtp creds on demand

Settings service calls POST /api/auth/internal/cache-bust (Bearer SETTINGS_SECRET)
after saving workforce or smtp integrations, so location/credential changes take
effect immediately without waiting for the 5-minute TTL or restarting the container.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/email.js

@@ -33,6 +33,11 @@ async function getTransporter() {
   return _transporter
 }
 
+export function invalidateCache() {
+  _smtpCache = null
+  _transporter = null
+}
+
 export async function sendPinEmail(to, name, pin) {
   const config = await getSmtpConfig()
   const transport = await getTransporter()