POST-1 — Add double opt-in before first Broadcast

[jenny07007]

Needed before any marketing send if legal/founder decides double opt-in is required for target jurisdictions. EU/GDPR strongly favors it; the call can be made at the time.

• Verify a sending domain in Resend
• Add confirmation email template (plain, on-brand, single CTA)
• Extend the integration: store new contacts as unsubscribed: true, send signed-token confirmation email, confirm route flips unsubscribed to false
• Form success copy switches to "Check your email"
• Token signing key in env vars
• Test full flow end-to-end before sending any Broadcast

---