NL-03 fixes: SPF merge safety, DMARC no-overwrite (p=none), custom MAIL FROM, tests

- SPF: reads existing apex TXT, merges include:amazonses.com — never creates second SPF, never drops existing mechanisms - DMARC: does not overwrite existing _dmarc record; defaults to p=none (monitoring) not quarantine - Custom MAIL FROM: bounce.{domain} MX + SPF for DMARC SPF alignment (region configurable via AWS_REGION) - CLI script shows before/after for SPF merge in dry-run - Add vitest + 17 tests covering all pure functions - Admin API GET now includes plan notes