Digest polish: honest on-site wording, one-tap opt-in after sign-in, List-Unsubscribe

* On-site end-cap now says "You're caught up for now." — honest, since Highlights
  refreshes through the day (the email keeps the daily "see you tomorrow").
* Anonymous "Get tomorrow's brief by email" now honors the one-tap promise:
  sets a pending flag, opens sign-in, and auto-enables once auth resolves.
* Email compliance (RFC 2369/8058): send_email takes optional headers; the digest
  sets List-Unsubscribe + List-Unsubscribe-Post=One-Click, and a POST
  /api/digest/unsubscribe handles native one-click (GET still serves the page).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_admin.py

@@ -230,4 +230,8 @@ def test_digest_toggle_and_unsubscribe(tmp_path, monkeypatch):
     assert "invalid" in TestClient(app).get(f"/api/digest/unsubscribe?u={uid}&t=nope").text.lower()
     assert "unsubscribed" in TestClient(app).get(f"/api/digest/unsubscribe?u={uid}&t={tok}").text.lower()
     assert tc.get("/api/auth/me").json()["digest_enabled"] is False
+    # RFC 8058 one-click POST also disables
+    tc.post("/api/account/digest", json={"enabled": True})
+    assert TestClient(app).post(f"/api/digest/unsubscribe?u={uid}&t={tok}").json() == {"ok": True}
+    assert tc.get("/api/auth/me").json()["digest_enabled"] is False
     assert TestClient(app).post("/api/account/digest", json={"enabled": True}).status_code == 401  # gated