No allowlist for links referenced inside outbound message bodies

Domains.allowlist / Domains.denylist (app/models/domains.js, lines 352 to 353) are only consulted in helpers/get-recipients.js, and only against inbound connection metadata (remoteAddress, resolvedClientHostname, resolvedRootClientHostname, originalFromAddress). There's no equivalent way to allowlist a specific hostname referenced inside an outbound message body against the Cloudflare Family/Security DNS check in Emails.queue().

Impact: a customer whose legitimate outbound content links to a domain Cloudflare's Family DNS miscategorizes (e.g. erowid.org, a harm-reduction resource, bundled in with adult
content) has no way to send that mail even knowingly, short of removing the link entirely.

Suggested fix: add a domain-scoped or account-scoped link-hostname allowlist, checked before the throw in Emails.queue()'s outbound phishing/malware/adult-content block.

Read app/models/domains.js lines 352-353 and helpers/get-recipients.js to understand the existing allowlist and denylist behavior, then trace Emails.queue() to the outbound phishing/malware/adult-content check. Done means a domain-scoped or account-scoped hostname allowlist can be applied to links in outbound message bodies before that check rejects the message.

Written by the indexing model from the issue text.