Record that someone who opted out consented again

The one exception to "only the recipient reverses their own STOP". It exists because refusing to build it does not prevent the reversal, it just moves it somewhere with no record — and the version with no record was a bug we shipped.

Narrow on purpose:

• evidenceRef is required, unlike an ordinary opt-in. An unevidenced claim about someone who has already said no is exactly the claim that must not be taken on trust.
• capturedAt must be after the opt-out. Consent collected before it is the consent they revoked, and replaying the original signup record is the most likely misuse.
• A number may be re-consented at most twice per brand. A third is refused outright: at that point consent and persistence are not distinguishable, and it goes to a human.
• Every reversal is written to an audit trail with the account, the evidence and the opt-out it reverses, readable at GET /v1/brands/{id}/optins/reconsents.

Texting START always works and is never rate-limited — it is the recipient's own channel.