feat: harden self-host profile gating, login fallbacks, and email contracts

[KevinLaucn]

Summary

• Self-host profile capability gating (cognition, scheduled actions, agents, docs collab) preventing 502s when services are off in default Email self-host profile
• Super Admin local fallbacks and self-host password login flow
• Decouple auth and storage collab surface token creation into dedicated queries
• Self-host email profile contract and drift check enhancements
• Lint fixes and CI service cache planner workflow updates