Record outreach-only opt-out (Lodestar marketing emails)

A valid CONFIRM_SECRET token (kind capo_unsub) opts out immediately. An email with no token, or a token that does not verify, does not opt out: the Worker emails a signed confirmation link and returns the same 200 whether or not the address exists. RFC 8058 one-click: POST application/x-www-form-urlencoded body List-Unsubscribe=One-Click to the signed https://lodestarstamp.com/v1/unsubscribe?email&license&token URL. A valid one-click POST returns 200 and does not redirect. The public form posts the same token in the body. Writes outreach_opt_out_v2 (string) on the Resend contact and CONSUMERS KV. Does not call Resend team suppressions and does not cancel Watching. Public form: https://lodestarstamp.com/unsubscribe