Production logs showed socket.create_connection to smtp-relay.brevo.com:587
timing out. HuggingFace Spaces blocks outbound 25/465/587 to prevent spam abuse,
so smtplib can never connect there regardless of credentials.
Mail now goes over HTTPS via the Brevo v3 API when BREVO_API_KEY is set, falling
back to SMTP for self-hosted deployments where the ports are open, and to logging
when neither is configured. Brevo's rejection body is logged, so an unverified
sender or bad key is diagnosable instead of silent.
fix: translator auto-detect returned an empty translation
Regression from the BUG-013 change: translation and language detection were
requested as a single JSON object, and the model frequently ignored that
contract. QA testing measured roughly 3 in 4 auto-detect translations coming
back empty, while explicit-source translations were unaffected.
Detection is now a separate best-effort call that cannot affect translation, and
an empty model response raises instead of surfacing a blank result.
Also tightens the password rule per QA follow-up on BUG-007: spaces and emoji
were accepted whenever a letter and a digit were also present.
