Email Unsubscribe
Public, no-auth one-click unsubscribe.
Validates the HMAC-signed token (issued at send time) and flips
the corresponding row in email_event_subscriptions to OFF.
event_type is also passed as a query param so we can validate
that the user clicked the link associated with the right matrix
row. If the param doesn’t match the token’s claim we 400 — defends
against truncated or substituted links.
Critical for CAN-SPAM / GDPR / RFC 8058 one-click compliance.
Returns a tiny HTML page so a click straight from the inbox lands
somewhere intelligible; the same endpoint also handles the
automated List-Unsubscribe-Post POST that Gmail/Apple Mail
fire (we accept both verbs against the same handler — see below).