fix: restore watermark image in email templates

The previous commit incorrectly removed the watermark — only the
style extraction into <style> blocks was requested. Restores the
watermark <img>, {{watermarkUrl}} placeholder resolution in both
EmailConnectorService and PasswordResetNotificationService, and
the corresponding test assertions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/main/java/net/siegeln/cameleer/saas/notification/PasswordResetNotificationService.java

@@ -1,6 +1,7 @@
 package net.siegeln.cameleer.saas.notification;
 
 import net.siegeln.cameleer.saas.identity.LogtoManagementClient;
+import net.siegeln.cameleer.saas.provisioning.ProvisioningProperties;
 import net.siegeln.cameleer.saas.vendor.EmailConnectorService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -27,11 +28,14 @@ public class PasswordResetNotificationService {
 
     private final EmailConnectorService emailConnectorService;
     private final LogtoManagementClient logtoClient;
+    private final ProvisioningProperties provisioningProps;
 
     public PasswordResetNotificationService(EmailConnectorService emailConnectorService,
-                                            LogtoManagementClient logtoClient) {
+                                            LogtoManagementClient logtoClient,
+                                            ProvisioningProperties provisioningProps) {
         this.emailConnectorService = emailConnectorService;
         this.logtoClient = logtoClient;
+        this.provisioningProps = provisioningProps;
     }
 
     /**
@@ -110,8 +114,12 @@ public class PasswordResetNotificationService {
         String content = new ClassPathResource("email-templates/password-reset-notification.html")
                 .getContentAsString(StandardCharsets.UTF_8);
 
+        String watermarkUrl = provisioningProps.publicProtocol() + "://"
+                + provisioningProps.publicHost() + "/platform/assets/email-watermark.png";
         String timestamp = ZonedDateTime.now(ZoneOffset.UTC).format(TIMESTAMP_FMT);
 
-        return content.replace("{{timestamp}}", timestamp);
+        return content
+                .replace("{{watermarkUrl}}", watermarkUrl)
+                .replace("{{timestamp}}", timestamp);
     }
 }

src/main/java/net/siegeln/cameleer/saas/vendor/EmailConnectorService.java

@@ -1,6 +1,7 @@
 package net.siegeln.cameleer.saas.vendor;
 
 import net.siegeln.cameleer.saas.identity.LogtoManagementClient;
+import net.siegeln.cameleer.saas.provisioning.ProvisioningProperties;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.core.io.ClassPathResource;
@@ -19,9 +20,11 @@ public class EmailConnectorService {
     private static final String SMTP_FACTORY_ID = "simple-mail-transfer-protocol";
 
     private final LogtoManagementClient logtoClient;
+    private final ProvisioningProperties provisioningProps;
 
-    public EmailConnectorService(LogtoManagementClient logtoClient) {
+    public EmailConnectorService(LogtoManagementClient logtoClient, ProvisioningProperties provisioningProps) {
         this.logtoClient = logtoClient;
+        this.provisioningProps = provisioningProps;
     }
 
     public record SmtpConfig(String host, int port, String username, String password, String fromEmail) {}
@@ -157,11 +160,14 @@ public class EmailConnectorService {
         return "SignInAndRegister".equals(signInExp.get("signInMode"));
     }
 
-    /** Load an email template from classpath. */
+    /** Load an email template from classpath and resolve the watermark URL placeholder. */
     private String loadTemplate(String filename) {
         try {
-            return new ClassPathResource("email-templates/" + filename)
+            String content = new ClassPathResource("email-templates/" + filename)
                 .getContentAsString(StandardCharsets.UTF_8);
+            String watermarkUrl = provisioningProps.publicProtocol() + "://"
+                + provisioningProps.publicHost() + "/platform/assets/email-watermark.png";
+            return content.replace("{{watermarkUrl}}", watermarkUrl);
         } catch (IOException e) {
             throw new IllegalStateException("Failed to load email template: " + filename, e);
         }