Unsubscribe endpoint

Every message carries a List-Unsubscribe header and a link in the footer. Both point here, and both work without a session — a mailbox provider calls it unattended when someone presses the unsubscribe control beside your name, and the recipient themselves arrives from the link.

A signature in the URL stands in for the session, so the endpoint can be public without letting anyone unsubscribe anyone.

An unsubscribe is permanent and applies to the address across every future search, not just the campaign that prompted it. There is no way to re-add someone from the dashboard, which is the correct behaviour rather than a missing feature.