Unsubscribe from an optional-email family (the link in the footer)

Opened by a person, from their inbox, so it answers with an HTML page rather than JSON — rendered in the recipient's own locale. The token is an HMAC over userId:family minted into the email itself — no session, nothing to enumerate, and no expiry, because an unsubscribe link in a two-year-old email must still work. Applies to the three OPTIONAL families only; essential email (sign-in codes, receipts, security alerts, terms updates) has no opt-out. Every write merges, so unsubscribing from one family never resubscribes another.