Stop unsafe email before provider handoff. Not after the damage is done.

Everything here runs inside one send function, so there is no route to a provider that skips it — not the API, not a flow, not an agent, not a retry from a queue.

• Hard bounces and complaints suppress future mail automatically, and complaints can never be un-suppressed.
• A dead mailbox is checked once before its first send, so it never costs you a bounce.
• The kill switch and daily cap are re-checked at dispatch, so work queued before you paused still stops.
• If a count can't be read, the send is refused rather than treated as under the cap.