feat: one-click unsubscribe — token-based flow

[nimit2801]

Summary

Every email needs a working unsubscribe link. Build a token-based unsubscribe flow.

Scope

• Add unsubscribe_token uuid column to subscribers table (migration)
• Generate token on insert (gen_random_uuid())
• New GET /api/unsubscribe?token=xxx route — sets unsubscribed_at, returns confirmation page
• Embed unsubscribe link in all email templates
• Optional: /unsubscribed page with brand styling confirming removal

Effort: 3 points