feat(testing): add vitest suite + guerrilla mail email pool

- Vitest unit tests for POST /api/erase: validation, form-only
  providers, all email providers, CRLF sanitization
- Snapshot on PROVIDER_DATA to catch provider config drift
- Mock via require cache to avoid nodemailer/sendmail dependency
- sendErasureMail call assertions (args + call count)
- fetch-test-emails.mjs script to refresh disposable email pool
- mailer: add Reply-To header pointing to requester email
- mailer: fallback to direct transport when sendmail unavailable

api/services/mailer.js

@@ -2,11 +2,16 @@
 
 const nodemailer = require('nodemailer');
 
-const transporter = nodemailer.createTransport({
-  sendmail: true,
-  newline: 'unix',
-  path: '/usr/sbin/sendmail'
-});
+const { execSync } = require('child_process');
+
+function hasSendmail() {
+  try { execSync('ls /usr/sbin/sendmail', { stdio: 'ignore' }); return true; }
+  catch { return false; }
+}
+
+const transporter = hasSendmail()
+  ? nodemailer.createTransport({ sendmail: true, newline: 'unix', path: '/usr/sbin/sendmail' })
+  : nodemailer.createTransport({ direct: true });
 
 /* ============================================================
    DATOS DE PROVEEDORES
@@ -108,6 +113,7 @@ exports.sendErasureMail = async ({ provider, email, nickname, phone, address, ex
 
   await transporter.sendMail({
     from:    'privacy@resetea.net',
+    replyTo: email,
     to:      providerInfo.email,
     subject: `Ejercicio derecho de supresión (RGPD Art. 17) — ${providerInfo.name}`,
     text:    letterText,