Filter bot, security-scanner and Apple MPP opens and clicks #37

/track/open and /track/click count every request. Security scanners click every link, and Apple Mail Privacy Protection prefetches every pixel, so opens and clicks are inflated. That makes engagement-based features unreliable, especially #29 (dormant contacts), where nobody would ever look dormant.

Proposal

• Clicks: don't count clicks whose user agent is missing or matches scanner patterns (bot|crawl|spider|preview|scan|proofpoint|mimecast|barracuda|safelinks|python|curl|wget|java/|okhttp|go-http|headless), or that arrive within about 30s of send. Still redirect them. These are the rules from https://github.com/marclou/mailcheap.
• HEAD requests: respond but never count.
• Opens: flag likely MPP/proxy opens (Apple proxy user agent and IP ranges, Google Image Proxy fetches right after delivery) as machine_open. Exclude them from "unique opens" and from engagement decisions, but keep them visible.
• A click implies an open for the same message when images are blocked.
• Unsubscribe links are never wrapped for click tracking, and an unsubscribe never counts as engagement.
• Store the classification on email_events so reports can show human vs machine numbers.