Redesign transactional emails (embedded navy-violet templates) + display name endpoint

[thomasluizon]

Summary

#166 — Transactional email redesign. All five emails (verification code, welcome, account deletion, agent step-up reuse, internal support) move out of interpolated C# strings into embedded-resource .html/.txt templates under src/Orbit.Infrastructure/Email/Templates/ with ONE shared layout. A single-pass {{token}} renderer (no templating library; values are never re-scanned, so user content cannot inject tokens) composes them. Restyled on the navy-violet orbital system, dark navy baked in: #020618 canvas, flattened #111526 cards, violet #7F46F7 pill CTA with glow, gradient header band on welcome with solid bgcolor Outlook fallback, Rubik/Inter/Roboto stacks with system fallbacks, hosted no-bg logo with styled alt-text wordmark fallback. Every user-facing email now ships a plain-text part and a preheader. Copy and subjects are byte-identical (the 13 pre-existing email tests pass unchanged). IEmailService and all callers untouched.

#167 (backend) — Editable display name. PUT /api/profile/name → SetNameCommand → User.SetName (trims, rejects empty/whitespace, max 50 chars via DomainConstants.MaxUserNameLength; no uniqueness, it is a display name). FluentValidation mirrors the domain rules. Action registered in the agent catalog under ProfilePreferencesWrite.

Refs thomasluizon/orbit-ui-mobile#166
Refs thomasluizon/orbit-ui-mobile#167
Paired frontend PR: thomasluizon/orbit-ui-mobile#171 — merge THIS PR first (API contract).

Manual render check (#166 acceptance — run before merge)

• Gmail web: verification, welcome, deletion (navy canvas, violet code well, pill CTA, logo)
• Gmail Android: same three
• Outlook: welcome header degrades to solid violet-950 band; squared cards acceptable; CTA legible
• Apple Mail: Rubik/Inter load via @import; gradient renders
• Images blocked: styled "Orbit" alt wordmark shows in the header
• Plain-text part present on all user-facing emails

Validation

• dotnet build 0 errors; dotnet test 3,196/3,196 (Domain 358 / Infrastructure 1,020 / Application 1,818)
• New tests: renderer (12, incl. token-injection guard + embedded-resource loading), service (11, incl. text part + preheader + encoding), SetName domain/handler/validator (18)

🤖 Generated with Claude Code

[claude]

Two well-scoped features land cleanly here.

Email redesign (#166): The move from C# string-interpolated HTML blobs to embedded-resource templates with a shared layout is a clear improvement in maintainability. The single-pass Regex.Replace renderer correctly prevents token-injection (substituted values are never re-scanned), user content is HTML-encoded for HTML templates and URL-encoded for URLs, and the ConcurrentDictionary cache is properly scoped to the assembly lifetime. All five templates ship plain-text parts and preheaders; the HTML/text copy split (htmlCopy encodes userName, textCopy stays raw) is handled correctly. Test coverage is thorough: renderer tests hit every template for leftover tokens, verify the no-rescan invariant, and cover missing-template/missing-token failure paths; service tests verify encoding, gradient header, text-part presence, and the token-injection guard end-to-end.

Display name endpoint (#167): PUT /api/profile/name inherits the class-level [Authorize], uses HttpContext.GetUserId() (no IDOR risk), and the domain guard in User.SetName trims then validates — matching the FluentValidation layer. The DomainConstants.MaxUserNameLength constant flows cleanly through to AppConstants for the validator and the agent catalog description update is accurate. Command, validator, and domain tests cover the boundary cases (exact max, trimmed max, whitespace, accented characters, user-not-found).

[sonarqubecloud]

Quality Gate passed

Issues
66 New issues
0 Accepted issues

Measures
0 Security Hotspots
94.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud