Background

#287 (styled email approve/cancel buttons + summary block) called for a List-Unsubscribe header on outgoing approval emails so a recipient added to a notification list they didn't ask for can self-serve out. The header requires a per-recipient mute endpoint backend, which doesn't exist today — so #287 deferred this and shipped without the header.

This issue tracks adding the endpoint + the header.

What needs to happen

1. Per-recipient mute endpoint: GET /api/notifications/unsubscribe?token=<signed-recipient-token> (token-only, AuthPublic like the approve/cancel routes). Idempotent. Returns a small confirmation page. The token signs the (recipient_email, scope) tuple so a stray subscriber can opt out of "purchase approvals" without losing other notifications.
2. muted_recipients table (or column on a per-recipient settings table — confirm the existing notifications schema):
   • recipient_email (text)
   • scope (enum: purchase_approvals / ri_exchange_approvals / etc.)
   • muted_at
3. Email send path consults the mute table before adding a recipient to To/Cc.
4. List-Unsubscribe header on outgoing emails:

   List-Unsubscribe: <https://.../api/notifications/unsubscribe?token=...>, <mailto:unsubscribe@...?subject=Unsubscribe>
   List-Unsubscribe-Post: List-Unsubscribe=One-Click
   

   The One-Click variant is what Gmail / Outlook surface as the "Unsubscribe" affordance in the message header.
5. Test: subscribe email → mute via the endpoint → next send to that recipient skips them in To/Cc.

Acceptance

• A recipient can click the List-Unsubscribe header link or affordance and stop receiving the targeted notification scope.
• The mute is per-scope: opting out of purchase-approval emails does NOT mute RI-exchange emails (or whatever scopes exist).
• The send path filters the recipient list at send time, not at template-render time.

References

• feat(email): styled approve/cancel buttons + rec summary block in notification emails #287 (parent — deferred this header for v1)
• internal/api/handler_purchases.go:1167 (SendPurchaseApprovalRequest call site — recipient set computed here)
• internal/email/sender.go::SendToEmailWithCC* (the per-send recipient assembly point — natural place to consult the mute table)