STARTTLS and authenticate before sending the email 🟩

Pins the auth handshake delivered with the tracer green (no red phase);
discriminating: an unauthenticated/cleartext send would be rejected by SES.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/infrastructure/email/test_ses_smtp_email_sender.py

@@ -75,3 +75,30 @@ def test_send_delivers_a_plaintext_message_with_the_right_envelope() -> None:
     assert message["From"] == "noreply@domna.homes"
     assert message["Subject"] == "Your document download is ready"
     assert "https://signed-url" in message.get_content()
+
+
+def test_send_starts_tls_and_authenticates_before_sending() -> None:
+    # Arrange — SES SMTP rejects unauthenticated, cleartext senders, so the
+    # transport must STARTTLS and log in with the SMTP credentials.
+    created: list[_FakeSmtp] = []
+
+    def factory(host: str, port: int) -> _FakeSmtp:
+        smtp = _FakeSmtp(host, port)
+        created.append(smtp)
+        return smtp
+
+    sender = SesSmtpEmailSender(
+        host="email-smtp.eu-west-2.amazonaws.com",
+        port=587,
+        username="AKIA_SMTP_USER",
+        password="smtp-password",
+        from_address="noreply@domna.homes",
+        smtp_factory=factory,
+    )
+
+    # Act
+    sender.send(to="user@example.com", subject="s", body="b")
+
+    # Assert
+    assert created[0].started_tls is True
+    assert created[0].login_args == ("AKIA_SMTP_USER", "smtp-password")