feat: guest purchase delivery & activation system

- Add PENDING_ACTIVATION status for users with existing subscriptions
- Add activation endpoint POST /landing/activate/{token}
- Send email notifications on delivery and pending activation
- Add 3 email templates (delivered, activation required, gift received) in 5 languages
- Extract purchase status response builder to reusable helper
- Move activation logic to service layer
- Add header injection protection in email service
- Add Literal type guard for contact_type parameter
- Fix _mask_email crash on malformed input
- Pre-resolve notification params before commit to avoid DetachedInstanceError

app/database/models.py

@@ -3023,6 +3023,7 @@ class GuestPurchaseStatus(str, Enum):
     PENDING = 'pending'
     PAID = 'paid'
     DELIVERED = 'delivered'
+    PENDING_ACTIVATION = 'pending_activation'
     FAILED = 'failed'
     EXPIRED = 'expired'