Subscribe a contact to a list

Project-scoped equivalent of POST /v1/subscriber-lists/{id} (which is a legacy flat URL shape kept for hosted signup forms - it also accepts a whitelisted Origin header and CAPTCHA, neither of which apply here). Creates the contact if it doesn't exist yet. Accepts a SubscriptionToken in place of an api key - see that security scheme's description for how a custom subscription-preferences page uses this to let a subscriber re-join a list they had left.

Double opt-in: when it is on for the list and the request uses an API key (or a whitelisted Origin), a new contact - or one who is unverified or unsubscribed on the list - is not activated. They get the verification email and stay as they are (new contacts become "unverified") until they click its link, and the response is { success: true, info } instead of the subscriber. Sending status "active" does not skip this. A paused subscriber is reactivated directly, without an email. With a SubscriptionToken the subscriber has already proven they own the address, so they are activated directly.