Inject AWS SES secrets into tournament deployments

[JoeyRubas]

Summary

• inject AWS SES credentials as DigitalOcean secrets when creating tournament apps
• pass through SES, Mail Manager, and sender configuration
• document the deployer environment variables and add app-spec regression coverage

BOARD_PASSWORD injection is already present on master, and mit-tab already consumes it during first-time tournament initialization.

Testing

• uv run python -m unittest discover -s tests -v
• targeted mit-tab initialization and email tests
• mit-tab dependency-age check, pylint, and npm lint