At-least-once delivery with deduplication guard

At-least-once delivery guarantees that a job is processed at least once — it does not guarantee it is processed exactly once. If a worker sends a password-reset email, then crashes before acknowledging the job, BullMQ re-queues it and the next worker pickup sends an identical email. For transactional messages, duplicates erode user trust immediately. CWE-362 covers race conditions on shared resources; duplicate sends are precisely that class of failure. ISO-25010:2011 reliability.fault-tolerance requires the system to behave correctly despite component failures.

Add a pre-flight dedup check at the start of the job processor in workers/email.worker.ts, before calling the ESP:

async function processEmailJob(job: Job<EmailJobData>) {
  const { campaignId, recipientId } = job.data

  const existing = await db.emailSendLog.findFirst({
    where: { campaignId, recipientId, status: 'sent' }
  })
  if (existing) {
    logger.info({ campaignId, recipientId }, 'Duplicate job — skipping')
    return
  }

  await db.emailSendLog.create({
    data: { campaignId, recipientId, status: 'sending', jobId: job.id }
  })

  const result = await esp.send(job.data)

  await db.emailSendLog.update({
    where: { campaignId_recipientId: { campaignId, recipientId } },
    data: { status: 'sent', espMessageId: result.messageId, sentAt: new Date() }
  })
}