[amandazhuyilan]

SBP-674: add SBP bundle approval and rejection emails

Changes

• Add sbp_portal_url setting (mirrors aai_portal_url's env-driven default pattern)
• Add SBP-specific approval email (compose_sbp_bundle_approval_email + sbp_bundle_approved.html), using content here, linking to the SBP platform
• Add SBP-specific rejection email (compose_sbp_bundle_rejection_email + sbp_bundle_rejected.html), using content here for the early-access invite-only period, linking to SBP support Freshdesk link.
• Wire approve_group_membership to send the new SBP approval email instead of the generic bundle-approval email
• Wire reject_group_membership to send the new SBP rejection email — previously SBP rejections sent no email at all (only TSI did)
• Add tests: composer unit tests, end-to-end admin API tests, and an sbp_group fixture

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have added unit / integration tests that prove my fix is effective or that my feature works
• I have run all tests locally and they pass
• I have updated the documentation (if applicable)
• For any new secrets, I have updated the shared spreadsheet and the GitHub Secrets.

Test plan

All tests shall pass!

[marius-mather]

looks great! good to go