Enable or disable all email to a member

Flip a member's email kill switch: disabled=true stops ALL email to that address (marketing AND transactional: billing, security, account), disabled=false restores it.

This is an all-category suppression keyed on the member's address, so it holds no matter which trigger fires and survives a Slack roster re-sync (the suppression store is not touched by sync). It is reversible only here (an admin action). Idempotent: re-disabling an already-disabled member (or re-enabling an already-enabled one) is a no-op that still returns the current state.

A re-enable removes ONLY this admin kill switch; if the address also hard-bounced, that separate suppression stays in force and the member remains unreachable until the bounce is resolved.

Known limit: the switch is ADDRESS-scoped. If a member's platform email changes (roster sync retires the old membership and creates a new one), the suppression stays on the old address and the new row shows email enabled, and the admin must re-flip it there. Person-scoped enforcement is a follow-up owned by the roster-sync policy.