Adds an internal reply of the caller on the email and publishes an EAppMailRepliedEvent. Mentions must be of type user, reference users of the tenant and have distinct order values. Returns the updated record.

The record is looked up within the caller's tenant, and the caller must also be allowed to access the entity the email is linked to (employer, customer, lead, workflow or meeting, checked in that order); otherwise that entity's access check rejects the request. The caller also needs the update permission of the linked entity type (employers:write, leads:update, workflows:update, customers:update or meetings:update), checked in the service layer.

Errors: 400 if a mention is invalid; 403 if the update permission is missing; 404 if the record or a mentioned user does not exist.