Security: Prevent bot-forced Mailchimp subscriptions from /api/signup/

## Problem
The current signup flow can subscribe users to Mailchimp before email ownership is verified.

- `/api/signup/` accepts public POSTs and triggers `SubscribeToMailingList(...)` when `newsletter_signup` is set.
- The Mailchimp helper uses `status: "subscribed"` (immediate subscription), not a pending confirmation flow.
- Signup has CSRF protection, but no explicit anti-bot control on this route (captcha/challenge or dedicated server-side rate limiting for this endpoint).

## Risk
Bots can create accounts using third-party email addresses and force unsolicited newsletter subscriptions. This creates abuse/compliance risk and can degrade sender reputation.

## Suggested solution
1. Delay newsletter subscription until email is verified.
2. Change Mailchimp member creation to `status: "pending"` (double opt-in behavior).
3. Add anti-automation controls to signup:
- server-side captcha verification (or equivalent challenge), and/or
- endpoint-level rate limiting by IP + email fingerprint.
4. Replace per-request thread spawn in Mailchimp helper with background queue/job processing.
5. Reduce PII in error logs for failed Mailchimp calls.

## Acceptance criteria
- A new account with `newsletter_signup=true` is **not** subscribed until email verification succeeds.
- Mailchimp receives `pending` status and user must confirm via email.
- Repeated bot-style signup attempts are throttled/blocked.
- No raw email addresses are emitted in Mailchimp error logs.