beta-launch: respect returning-user opt-out + show digest job in ops LEDs

- verify_submit now applies the subscribe checkbox only at first sign-up.
  Returning users keep whatever they set via Settings or the one-click
  unsubscribe link — previously, every login silently re-enrolled them.
- JOB_NAMES gains email_digest_job so the ops footer reflects its health.

Adds tests/test_verify_subscribe.py::test_returning_user_login_preserves_unsubscribe.

app/routers/auth.py

@@ -240,9 +240,14 @@ async def verify_submit(
     if user is None:
         # User row vanished between cookie issue and verify. Restart flow.
         return RedirectResponse(url="/login", status_code=303)
+    is_first_login = user.last_login_at is None
     user.last_login_at = utcnow()
-    # An unchecked HTML checkbox sends NO field; that means "opt out".
-    user.email_digest_opt_in = subscribe_to_digests is not None
+    # Apply the verify-page subscribe checkbox ONLY at first sign-up. After
+    # that, Settings (and the one-click unsubscribe link) own the preference
+    # — re-applying on every login would silently re-subscribe users who
+    # explicitly opted out.
+    if is_first_login:
+        user.email_digest_opt_in = subscribe_to_digests is not None
     await session.commit()
     log.info("user.login", user_id=user.id, email=email)