Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/public-api/src/controllers/mail.controller.js`:
- Around line 33-46: Replace the split INCR/EXPIRE/DECR sequence with a single
atomic Redis EVAL (Lua) call so increment, TTL initialization, limit check and
potential rollback happen inside Redis; implement a Lua script invoked with
redis.eval that: 1) increments KEYS[1], 2) if the resulting value is 1 sets
EXPIRE to ARGV[1] (ttlSeconds), 3) if the value > tonumber(ARGV[2]) (limit)
decrements the key and returns an error indicator, otherwise returns the new
count; call the script with KEYS = [key] and ARGV = [ttlSeconds, limit], throw
the 429 error in JS when the script indicates limit exceeded, and keep existing
key naming (project:mail:count:{projectId}:{YYYY-MM}) and variable names (redis,
key, ttlSeconds, limit, consumedQuotaKey) so caller logic remains unchanged.
- Around line 49-56: The handler sendMail currently returns raw { error: ... }
and err.message on early returns and in the catch, breaking the public API
contract; import and use the AppError class and always respond with the standard
envelope { success: boolean, data: {}, message: string } on failures. Replace
the secret-key check return (and other early returns around the sendMail
function, including the blocks referenced at 61-67, 81-83, 121-135) so they
either throw new AppError("Forbidden. This action requires a Secret Key
(sk_live_...).", 403) or call res.status(...).json({ success: false, data: {},
message: "..." }) constructed from AppError; update the catch block to map any
caught error to an AppError (don’t expose err.message or DB errors) and respond
with res.status(appErr.statusCode||500).json({ success: false, data: {},
message: appErr.message }). Ensure consumedQuotaKey cleanup/logic remains
unchanged.

In `@packages/common/src/index.js`:
- Around line 25-26: The destructuring import mistakenly declares
initAuthEmailWorker twice which is a syntax error; update the destructuring to
include each exported symbol only once (e.g., keep authEmailQueue and
initAuthEmailWorker and remove the duplicate initAuthEmailWorker) so the
require("./queues/authEmailQueue") statement correctly binds authEmailQueue and
initAuthEmailWorker without duplication.

---

Outside diff comments:
In `@packages/common/src/index.js`:
- Around line 98-103: The module currently exports initWebhookWorker but forgot
to export initAuthEmailWorker; open the exports list in
packages/common/src/index.js and add initAuthEmailWorker alongside
initWebhookWorker (and related exports like enqueueWebhookDelivery,
authEmailQueue) so that initAuthEmailWorker is available to consumers such as
apps/public-api; ensure the symbol name matches the imported identifier used
elsewhere.

---

Nitpick comments:
In `@AGENTS.md`:
- Around line 170-176: The documentation mixes planned and completed items for
v0.9.0; create two separate header sections—"Planned for v0.9.0" and "Shipped in
v0.9.0"—then move the completed webhook entries (Model:
packages/common/src/models/Webhook.js, Delivery log:
packages/common/src/models/WebhookDelivery.js, Dispatcher:
apps/public-api/src/utils/webhookDispatcher.js, Queue: BullMQ + existing Redis
connection, Retry: exponential backoff, max 5 attempts, stop on 4xx, Signature:
HMAC-SHA256 in X-urBackend-Signature header) into the "Shipped in v0.9.0"
section and leave only outstanding tasks under "Planned for v0.9.0" to make
handoffs clearer.

In `@apps/public-api/src/__tests__/mail.controller.test.js`:
- Around line 65-115: The tests must assert actual BYOK routing and rollback on
send failure: update the tests for mailController.sendMail to mock/spy the
Resend constructor and the emails.send method (referencing the Resend
constructor and emails.send) and assert that when decrypt returns a key the
Resend instance was created with that BYOK key and when decrypt returns null it
was created with the default key; additionally add a test where emails.send is
mocked to throw and confirm redis.decr is called (rollback) and the controller
returns the appropriate error response (use mailController.sendMail, redis.decr,
and emails.send in the assertions).