[DT-4263][3/7] Add DAR codes and DUOS-IDs to email sends

[kevinmarete]

Addresses

https://broadworkbench.atlassian.net/browse/DT-4263

Security risk: low — adds DAR codes and dataset IDs to an admin-only read endpoint; both are already visible to admins elsewhere.

Summary

Stacked on #3142. Each send from GET /api/mail/sends now carries darCode and datasetIdentifiers, for the Email Log's DAR-ID and DUOS-ID columns agreed on DT-4084 (one dataset shows its ID, several show "Multiple").

email_entity.entity_reference_id holds a different thing per email type. The new EmailReference enum records which, in an exhaustive switch over EmailType, so a new email type doesn't compile until it's classified:

Stored reference	Types	DAR code	DUOS-IDs
DAR code	NEW_DAR, NEW_CASE, approvals	itself	the submitted DAR's datasets, not its progress reports'
DAR or progress report id	SO, expiry, closeout, RADAR	the row's collection; a progress report shares its parent's	that row's datasets
Election id	REMINDER	the election's DAR	the election's dataset, else the DAR's
DUOS-ID / dataset name	dataset approved/denied, NEW_DATASET	—	that dataset

Other types (digests, DAA, library card, study emails) come back with no DAR code and no datasets. #3148 narrows approval and progress-report emails and adds study emails.

• EmailReference reaches the query as one kinds list indexed by email type number (kinds[email_type]), not one list per kind, so the lists can't be passed in the wrong order.
• Older rows that stored a different kind of reference are read as what they hold: a DAR reference id on a DAR-code type, a DAR code on a reference-id type (DAR_EXPIRED did briefly in 2025), and a dataset name on DATASET_APPROVED/DENIED, which stored names until 2026.
• The query returns dataset aliases and the mapper formats them with Dataset.parseAliasToIdentifier, so the DUOS-ID format has one definition.
• The lookups run after paging, so only the page's sends are looked up.
• Datasets are read as they are now, not when the email was sent: nothing records them at send time.

Reading the query

The CTEs up to sends are #3142's. The final SELECT joins each send to dar_collection by code, to election by id, then to data_access_request by reference id (or the election's DAR), and the LATERAL subquery collects dataset aliases from whichever of those matched.

Example: a REMINDER whose reference is 42 joins election 42, reaches its DAR through election.reference_id, takes darCode from that DAR's collection, and returns election 42's dataset as the one DUOS-ID.

---

Have you read CONTRIBUTING.md lately? If not, do that first.

• Label PR with a Jira ticket number and include a link to the ticket
• Label PR with a security risk modifier [no, low, medium, high]
• PR describes scope of changes
• Get a minimum of one thumbs worth of review, preferably two if enough team members are available
• Get PO sign-off for all non-trivial UI or workflow changes
• Verify all tests go green
• Test this change deployed correctly and works on dev environment after deployment

🤖 Generated with Claude Code