Unsubscribe

Opt a user out of lifecycle email. Idempotent.

With a valid signed link: one-click opt-out. Without one (bare URL, missing or bad params): the self-serve email form — same page for every invalid shape, so nothing about existing ids leaks. ?email= only prefills the form; unsubscribing still takes the explicit POST.