Feedback reply: Reply-To header routes reader replies to our inbox

Per Codex: outgoing reply now sets Reply-To = GOODNEWS_REPLY_TO_EMAIL, falling
back to the From address. Never the reader's own address (they're the recipient).
send_email gained an optional reply_to param. Failed-send stays UI-only (draft
kept) — no schema change, per Codex's lean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_email_reply_to.py

@@ -0,0 +1,48 @@
+import goodnews.email_send as es
+
+
+class _FakeSMTP:
+    last = {}
+
+    def __init__(self, *a, **k):
+        pass
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *a):
+        return False
+
+    def ehlo(self):
+        pass
+
+    def starttls(self, context=None):
+        pass
+
+    def login(self, *a):
+        pass
+
+    def send_message(self, msg):
+        _FakeSMTP.last = {"To": msg["To"], "Reply-To": msg["Reply-To"], "From": msg["From"]}
+
+
+def _arm(monkeypatch):
+    monkeypatch.setenv("GOODNEWS_SMTP_HOST", "smtp.example.com")
+    monkeypatch.setattr(es.smtplib, "SMTP", _FakeSMTP)
+
+
+def test_reply_to_uses_env_inbox(monkeypatch):
+    _arm(monkeypatch)
+    monkeypatch.setenv("GOODNEWS_REPLY_TO_EMAIL", "inbox@upbeatbytes.com")
+    es.send_feedback_reply("reader@x.com", "hello", "<p>hello</p>", "original?")
+    assert _FakeSMTP.last["Reply-To"] == "inbox@upbeatbytes.com"
+    assert _FakeSMTP.last["To"] == "reader@x.com"          # reader is recipient
+    assert _FakeSMTP.last["Reply-To"] != "reader@x.com"     # never the reader
+
+
+def test_reply_to_falls_back_to_from(monkeypatch):
+    _arm(monkeypatch)
+    monkeypatch.delenv("GOODNEWS_REPLY_TO_EMAIL", raising=False)
+    monkeypatch.setenv("GOODNEWS_SMTP_FROM", "Upbeat Bytes <hello@upbeatbytes.com>")
+    es.send_feedback_reply("reader@x.com", "hi", None, "o")
+    assert _FakeSMTP.last["Reply-To"] == "Upbeat Bytes <hello@upbeatbytes.com>"