Per https://datatracker.ietf.org/doc/html/rfc8058,
we send "announcement" mails with
List-Unsubscribe: <${apiUrl}/unsubscribe/${userId}/${oneClickUnsubscribeToken}>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
and handle
POST /api/unsubscribe/:user/:token => this unsubscribes
GET /api/unsubscribe/:user/:token => 302 /unsubscribe/:user/:token
GET /unsubscribe/:user/:token => user-visible page with clickthrough confirmation
In this configuration, compatible MUAs will show an "unsubscribe" button
that, when clicked, will POST to the URL directly
Less-compatible MUAs (and scanners) will open the page directly
which will redirect to a click-though; interactive users will be able to
unsubscribe, scanners won't unsubscribe by accident
Nothing /actually/ sends non-reactive mails,
so this is never used at this time
Closes#854
c6e4c9294f
