Unsubscribe contacts on spam complaint and allow manual suppressions #40

Two small gaps in how suppressions affect contacts:

1. A spam complaint doesn't unsubscribe the contact. It only adds an email_suppressions row, and contacts.subscribed stays true. The contact still looks subscribed in the UI and API, and the row disappears from the suppression list if someone releases it. Industry practice (Mailchimp, Klaviyo) is to unsubscribe or mark "complained" permanently.
2. There's no way to add a manual suppression. The manual reason exists in the schema, but nothing creates it. Teams need to block addresses or domains (role accounts, legal requests, known spam traps).

Proposal

• On a complaint, set subscribed = false and record the reason. A released suppression shouldn't silently resubscribe someone who complained.
• Add POST /suppressions (email, reason manual, note) plus a UI action and an MCP tool. Consider bulk add, and domain-level suppressions.
• When a contact is created, or resubscribed through the public signup (Public subscribe endpoint and embeddable signup form #27), an address already on the suppression list keeps its suppressed state.