Migrate mailing list persistence from GitHub Secrets to Postgres

# Outcome

Use Postgres as the source of truth for report mailing list subscribers. GitHub Actions fetch recipients at runtime via the subscription manager; no recipient data is stored in GitHub Secrets.

# Acceptance criteria

- A `subscribers` table exists with unique `email` and a status field (`subscribed`, `unsubscribed`, `bounced`) plus timestamps.
- Existing recipients (from current GH secret/env var) are migrated into Postgres; the secret no longer contains recipient emails.
- Subscription Manager exposes an authenticated endpoint to list current subscribers (e.g., GET /api/subscribers?status=subscribed) returning plain emails.
- GitHub workflows use the endpoint to obtain recipients at runtime; supports dry-run.
- Unsubscribe/bounce states are respected when returning recipients.
- Basic audit logging for subscribe/unsubscribe/migration is in place.
- A short runbook documents migration steps, rollback, and how to add/remove subscribers post-migration.

# Notes

Minimal schema:

```sql
create table subscribers (
id uuid primary key default gen_random_uuid(),
email text not null unique,
status text not null check (status in ('subscribed','unsubscribed','bounced')),
subscribed_at timestamptz not null default now(),
unsubscribed_at timestamptz,
last_delivery_at timestamptz,
source text,
created_by text,
updated_at timestamptz not null default now()
);
create index on subscribers (status, email);
```