feat: add admin endpoint to send email announcements

[dragosp1011]

Context

• fixes #

Changes

• Add opt-in admin endpoint POST /admin/notifications/email (enabled only when ADMIN_NOTIFICATION_SECRET is set), gated by x-admin-secret
• Support configurable subject/body, with either an explicit recipient list (for preview/testing) or sendToAll: true for all verified users
• Validate explicit recipients are registered users; reject unknown addresses before sending
• Send via SendGrid personalizations (batched), with per-recipient fallback and failedRecipients returned for manual retry
• Wire env/Helm/.env.example config

[Copilot]

🟡 Changes recommended

There are confirmed issues in the new announcement email template and security/behavior concerns in the recipient resolution and secret-checking logic that should be addressed before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds an opt-in wallet-backend admin endpoint to send email announcements, gated by ADMIN_NOTIFICATION_SECRET and x-admin-secret, with SendGrid batching support and Helm/env wiring so it can be enabled safely in deployed environments.

Changes:

• Introduces /admin/notifications/email (only registered when ADMIN_NOTIFICATION_SECRET is set) with request validation for sendToAll vs explicit recipients.
• Implements EmailService.sendAnnouncementBatch() using SendGrid personalizations with per-recipient fallback and failure reporting.
• Adds controller/service unit tests and wires new configuration into .env.example and the wallet Helm chart.

File summaries

File	Description
packages/wallet/backend/tests/admin-notification/service.test.ts	Adds service-level tests for recipient resolution and SendGrid batch/fallback behavior.
packages/wallet/backend/tests/admin-notification/controller.test.ts	Adds controller + middleware tests, including “disabled when secret missing” behavior.
packages/wallet/backend/src/user/service.ts	Adds getVerifiedUserEmails() to support broadcasting to verified users.
packages/wallet/backend/src/middleware/isAdminSecret.ts	Adds admin-secret middleware to gate the endpoint.
packages/wallet/backend/src/email/templates/announcementEmail.ts	Adds HTML template for announcement emails.
packages/wallet/backend/src/email/service.ts	Adds batched announcement sending via SendGrid personalizations and fallback sending.
packages/wallet/backend/src/createContainer.ts	Conditionally registers the admin notification controller/service when enabled.
packages/wallet/backend/src/config/env.ts	Adds ADMIN_NOTIFICATION_SECRET env parsing/normalization.
packages/wallet/backend/src/app.ts	Wires the new admin route behind the middleware and env flag.
packages/wallet/backend/src/admin-notification/validation.ts	Adds request body validation schema and limits (e.g., max body length).
packages/wallet/backend/src/admin-notification/service.ts	Implements recipient resolution, validation, and send orchestration.
packages/wallet/backend/src/admin-notification/controller.ts	Adds controller handler that validates input and returns success responses.
packages/wallet/backend/.env.example	Documents the new env var used to enable the endpoint.
helm/testnet-wallet/values.yaml	Wires ADMIN_NOTIFICATION_SECRET as an optional secret-driven env var in Helm.

Review details

• Files reviewed: 14/14 changed files
• Comments generated: 5
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.