Alert admins on large contact imports for review (hosted) #74

Background

Big list uploads are the main way spammers abuse a newly opened email platform (purchased or scraped lists). Hosted SendLit has no admin visibility into this. Bulk contact import doesn't exist yet (#38; today only single POST /contacts, packages/api-contract/src/contract.ts:133). Once #38 ships, a new account could load a huge list and send to it on day one. Source: Jesse Hanley's anti-abuse checklist (shared by Marc Lou on X, 18 Oct 2026).

Part of #75 (hosted abuse prevention umbrella). Should ship together with #38.

Proposed fix

• When an import (CSV, bulk API or MCP) creates more than a threshold, alert hosted admins (Slack/email) with org, account age, plan, list size, the share of free/role/disposable addresses, and the source file name. Thresholds:
  • an absolute threshold (e.g. 5,000 contacts)
  • a relative jump (e.g. more than 3x the existing list)
  • lower thresholds for accounts under 30 days old
• Optionally hold sending to newly imported contacts until an admin approves, for new accounts above the threshold.
• Record imports in the org audit log (apps/api/src/organization/audit.ts).

Acceptance criteria

• Imports above the configured thresholds trigger an admin alert with the details above (tested)
• Optional hold-for-review on large imports from new accounts; admins can approve or reject
• Imports are recorded in the audit log
• Hosted-only flag; self-host unaffected