fix(email): detect and surface webhook send failures instead of claiming success

send_webhook_email() only returned False on a network exception — a
webhook that responded with a non-2xx status (bad URL, wrong API key,
misconfigured Power Automate flow) was still reported as delivered. Now
checks response.ok and returns False on rejection too.

send_password_setup_email() also never checked the return value at all,
so the admin's 'Send Email' action (including resending a password-reset
email after the user already set their password) always showed success
even when nothing was actually sent. Now raises a clear error instead.

backend/tests/test_password_setup_flow.py

@@ -84,6 +84,57 @@ def test_send_password_email_posts_to_webhook_and_issues_token(api, db, auth_hea
     assert token_row.used_at is None
 
 
+def test_send_password_email_fails_loudly_when_webhook_rejects(api, auth_headers, new_user_id):
+    """A webhook that's reachable but rejects the request (bad URL/API key,
+    wrong Power Automate config, etc.) must not be reported as a success —
+    previously the HTTP response status was never checked."""
+    api(
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook"},
+    )
+
+    from unittest.mock import MagicMock
+
+    fake_response = MagicMock(ok=False, status_code=404, text="not found")
+    with patch("app.services.webhook_email_service.requests.post", return_value=fake_response):
+        resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+    assert resp.status_code == 400
+    assert "failed to send" in resp.text.lower()
+
+
+def test_send_password_email_resend_after_password_set_is_a_reset_email(api, db, auth_headers, new_user_id):
+    """Once a user has already set their password, hitting 'Send Email'
+    again must still actually send — as a password-reset email — not
+    silently no-op."""
+    api(
+        "patch", "/api/v1/system/email-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook"},
+    )
+
+    with patch("app.services.webhook_email_service.requests.post") as mock_post:
+        resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+    assert resp.status_code == 200, resp.text
+    first_payload = mock_post.call_args.kwargs["json"]
+    assert first_payload["subject"] == "Set Your Password"
+
+    from app.models.password_setup_token import PasswordSetupToken
+    token_row = db.query(PasswordSetupToken).filter(
+        PasswordSetupToken.user_id == uuid.UUID(new_user_id),
+    ).first()
+    api(
+        "post", "/api/v1/auth/set-password", {},
+        json={"token": token_row.token, "new_password": "BrandNewPass123!@#"},
+    )
+
+    # Now the user has must_change_password=False — resending must still
+    # go through, this time as a reset email.
+    with patch("app.services.webhook_email_service.requests.post") as mock_post_2:
+        resp2 = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+    assert resp2.status_code == 200, resp2.text
+    mock_post_2.assert_called_once()
+    second_payload = mock_post_2.call_args.kwargs["json"]
+    assert second_payload["subject"] == "Reset Your Password"
+
 def test_set_password_with_valid_token_succeeds(api, db, auth_headers, new_user_id):
     api(
         "patch", "/api/v1/system/email-webhook-config", auth_headers,