log.Fatal on email scheduling / RSS / markdown errors terminates the web server

[can3p]

Every mail helper and admin notification ends like this:

err := s.Send(ctx, exec, ...)
if err != nil {
    log.Fatal(err)
}

log.Fatal calls os.Exit(1). dbsender.Send does a DB upsert, so any transient database error, or an aborted transaction, while a user comments, publishes, signs up or sends an invite terminates the whole web server. Deferred functions and the in-flight requests of other users go down with it.

Where: pkg/mail/*.go (new_post, confirm_waiting_list, post_prompt, invite, post_comment_participants, confirm_signup, post_comment_author, post_prompt_answer) and pkg/admin/notifications.go (4 places), pkg/admin/panics.go:74.

The same pattern is in cmd/web/main.go:448 and :620 (/rss/public, /rss/private), where an RSS serialization error exits the process.

pkg/markdown/modify.go (lines 45, 73, 135) calls log.Fatal on markdown transform errors, so content a user can influence could stop the server.

Reproduction

• Deterministic: call mail.PostCommentAuthor with a sender.Sender whose Send returns an error. The test binary exits with status 1 instead of getting the error back.
• In the app: while a user submits a comment, briefly stop Postgres or kill the connection, so the outgoing_emails upsert fails. The web process exits.

Fix direction: return the error to the caller. The mail functions already return error.