Add RFC 8058 one-click List-Unsubscribe headers to marketing sends

[clbotdev]

Summary

Adds RFC 8058 one-click unsubscribe headers to every marketing send (broadcasts and sequences share automation/process-ongoing-sequence.ts).

• apps/api/src/utils/mail.ts: new getListUnsubscribeHeaders(unsubscribeToken) returns
  List-Unsubscribe: <https://…/unsubscribe/:token> and List-Unsubscribe-Post: List-Unsubscribe=One-Click. It reuses the existing per-contact unsubscribe token and URL from Fix tracking link paths, confirm unsubscribes, require SUPPRESSION_HASH_KEY for self-host #43, so there is no new signing scheme.
• apps/api/src/automation/process-ongoing-sequence.ts: passes these headers to sendMail.
• Transactional mail is unchanged and still forwards only the headers the caller supplies.
• Header passthrough: sendMail forwards headers to the team's nodemailer SMTP transport, which every ESP preset uses (SMTP/SES/SendGrid/Mailgun/Postmark/Resend). No adapter drops them.
• No mailto: entry: there is no configured unsubscribe mailbox to receive one. The https one-click URL is what Gmail/Yahoo require.

Tests

• process-ongoing-sequence.test.ts: checks that both headers are on the sent mail.
• tracking/routes.test.ts: new test POSTs List-Unsubscribe=One-Click to /unsubscribe/:token, then checks for a 200 with no confirmation page and that the contact is unsubscribed.

Results

• pnpm --filter @sendlit/api test: 75 files / 429 tests passed
• pnpm --filter @sendlit/api typecheck: clean
• pnpm lint: clean

Closes #23