refactor(plugin-auth): move AuthManager's email and SMS delivery into auth-manager-email-sms-delivery.ts

Seven method bodies move unedited: sendChangeEmailNotice,
getOtpSendGuard, assertPhoneOtpSendAllowed, deliverPhoneOtp,
sendPhoneInviteSms, storedRecipientLocale and renderPhoneSmsBody. The
four module-level declarations only they read move with them: the SMS
quota refusal code and its matcher, the quota wall's 429, and the one
phone OTP send refusal code. The class keeps all seven methods, their
docblocks and signatures, and hands each body the members it reads.
The APIError pin's file list, the dispatcher error vocabulary row for
deliverPhoneOtp and the five-sends population comments follow the
moved text.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LSXBc2GCBwiAL7vV4kWkyr

Author: claude

packages/plugins/plugin-auth/src/api-error-code.pin.test.ts

@@ -180,6 +180,7 @@ describe('every new APIError( in plugin-auth/src carries an ADR-0112 code (#2424
       'auth-manager-actor-guards.ts',
       'auth-manager-sign-in-lockout.ts',
       'auth-manager-password-session-policy.ts',
+      'auth-manager-email-sms-delivery.ts',
     ];
     expect(sites.length).toBeGreaterThanOrEqual(30);
     expect(new Set(sites.map((s) => s.file)).size).toBeGreaterThanOrEqual(4);

packages/plugins/plugin-auth/src/auth-email-locale.test.ts

@@ -858,10 +858,12 @@ describe("#14641 — an invitation reads the INVITEE's own sys_user.locale", ()
  *
  * ⚠️ POPULATION of the class claim these blocks close, stated rather than
  * implied: the auth mail surface is the five `sendTemplate` call sites in
- * `auth-manager.ts` — `IEmailService` declares exactly two delivering members
- * (`send`, `sendTemplate`), plugin-auth's only `.send(` calls are the SMS
- * service's, and no other file under `plugin-auth/src` calls either. Those
- * five are the same five `driveAllFive` above drives and `TEMPLATES` names.
+ * `auth-manager.ts` and `auth-manager-email-sms-delivery.ts` (the body of the
+ * change-email notice) — `IEmailService` declares exactly two delivering
+ * members (`send`, `sendTemplate`), plugin-auth's only `.send(` calls are the
+ * SMS service's, and no other file under `plugin-auth/src` calls either.
+ * Those five are the same five `driveAllFive` above drives and `TEMPLATES`
+ * names.
  * Before this change four of them read the column and `sendMagicLink` did not;
  * `the whole surface reads it` is pinned below by driving all five against one
  * recipient-keyed engine, not by asserting it about this send alone.
@@ -1120,8 +1122,9 @@ describe('#15106 — the CLASS claim: all five auth sends read the recipient col
   });
 
   it('every one of the five sends is written in the stored language of its own recipient', async () => {
-    // ⚠️ POPULATION: the five `sendTemplate` sites in `auth-manager.ts` — the
-    // same five `driveAllFive` drives and `TEMPLATES` names, and the whole of
+    // ⚠️ POPULATION: the five `sendTemplate` sites in `auth-manager.ts` and
+    // `auth-manager-email-sms-delivery.ts` — the same five `driveAllFive`
+    // drives and `TEMPLATES` names, and the whole of
     // plugin-auth's mail surface (see this section's header). This is the pin
     // that closes the class; the per-send pins above only cover one member.
     //