Slice 6: notifications per §15

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/migrations/008_email_opt_out.sql

@@ -0,0 +1,9 @@
+-- §15.4: the email-bounce webhook flips a global opt-out on the user's
+-- row. Per §15.4, a global opt-out is the only durable response to a
+-- hard bounce — naming it as its own column keeps the override visible
+-- and reversible (e.g. on a user-requested re-subscribe).
+--
+-- Per-category toggles remain on the row alongside; the global opt-out
+-- short-circuits the per-category check at email_for() resolution time.
+
+ALTER TABLE users ADD COLUMN email_opt_out_all INTEGER NOT NULL DEFAULT 0;