feat(email): route SendGrid sends through EU data residency

Add SENDGRID_REGION (default "eu") and call set_sendgrid_data_residency()
so the app's transactional email (email.py -> SendGrid HTTP API) routes
through api.eu.sendgrid.com, keeping recipient PII and content in EU data
centers. Requires SENDGRID_API_KEY to belong to an EU regional subuser.

Note: the echo-directus container sends its own emails via SMTP and must
separately move to smtp.eu.sendgrid.net with the EU subuser key (infra).

Refs ECHO-832

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: spashii

echo/server/.env.sample

@@ -91,7 +91,12 @@ EMBEDDING_API_VERSION=
 # Email (SendGrid)
 ############################################################
 # API key for SendGrid transactional emails. Leave empty to disable sends.
+# For EU data residency this must be an EU regional subuser key.
 SENDGRID_API_KEY=
+# Data residency region: "eu" (default, routes via api.eu.sendgrid.com) or
+# "global". "eu" keeps recipient PII and content in EU data centers and
+# requires the key above to belong to an EU regional subuser.
+SENDGRID_REGION=eu
 EMAIL_FROM=do-not-reply@dembrane.com
 EMAIL_FROM_NAME=dembrane
 # Where "Request upgrade" CTAs route. Shared inbox per matrix v1.1 §11.

echo/server/dembrane/email.py

@@ -177,6 +177,12 @@ def send_email_sync(
         )
 
         sg = SendGridAPIClient(api_key)
+        # Pin the send to a data-residency region. "eu" routes through
+        # api.eu.sendgrid.com so recipient PII and content stay in the EU.
+        # The key must belong to a subuser in this region.
+        region = settings.email.sendgrid_region
+        if region and region != "global":
+            sg.set_sendgrid_data_residency(region)
         response = sg.send(message)
 
         if response.status_code >= 400:

echo/server/dembrane/settings.py

@@ -323,6 +323,15 @@ class EmailSettings(BaseSettings):
             "SENDGRID_API_KEY", "EMAIL__SENDGRID_API_KEY", "EMAIL_SMTP_PASSWORD"
         ),
     )
+    # SendGrid data residency region. "eu" routes sends through
+    # api.eu.sendgrid.com so recipient PII and content stay in EU data
+    # centers (GDPR). Requires an EU regional subuser key. "global" uses
+    # api.sendgrid.com. The key must belong to a subuser in this region.
+    sendgrid_region: str = Field(
+        default="eu",
+        alias="SENDGRID_REGION",
+        validation_alias=AliasChoices("SENDGRID_REGION", "EMAIL__SENDGRID_REGION"),
+    )
     from_email: str = Field(
         default="do-not-reply@dembrane.com",
         alias="EMAIL_FROM",