beta-launch: respect returning-user opt-out + show digest job in ops LEDs

- verify_submit now applies the subscribe checkbox only at first sign-up.
  Returning users keep whatever they set via Settings or the one-click
  unsubscribe link — previously, every login silently re-enrolled them.
- JOB_NAMES gains email_digest_job so the ops footer reflects its health.

Adds tests/test_verify_subscribe.py::test_returning_user_login_preserves_unsubscribe.

tests/test_verify_subscribe.py

@@ -83,3 +83,48 @@ def test_verify_with_checked_subscribe_keeps_opt_in(tmp_path, monkeypatch):
             u = await s.get(User, 10)
             assert u.email_digest_opt_in is True
     asyncio.run(_check())
+
+
+def test_returning_user_login_preserves_unsubscribe(tmp_path, monkeypatch):
+    """A user who unsubscribed (via Settings or the one-click link) must
+    not be silently re-enrolled when they log in again, even if the verify
+    page's default-checked checkbox gets submitted."""
+    from datetime import datetime, timezone
+
+    from app.services import otp_service
+
+    async def _ok(*args, **kwargs):
+        return None
+    monkeypatch.setattr(otp_service, "verify", _ok)
+
+    client, pending = _build(tmp_path)
+
+    # Simulate a returning user: previously logged in, then opted out.
+    async def _make_returning():
+        from app import db as db_mod
+        from app.models import User
+        async with db_mod._session_factory() as s:
+            u = await s.get(User, 10)
+            u.last_login_at = datetime(2026, 5, 20, 12, 0, tzinfo=timezone.utc)
+            u.email_digest_opt_in = False
+            await s.commit()
+    asyncio.run(_make_returning())
+
+    # They log in again. The verify checkbox is default-checked in the
+    # template, so the form will submit "on" — but the handler must NOT
+    # apply that to a returning user.
+    r = client.post(
+        "/verify",
+        data={"code": "000000", "subscribe_to_digests": "on"},
+        cookies={"cassandra_pending": pending},
+        follow_redirects=False,
+    )
+    assert r.status_code == 303
+
+    async def _check():
+        from app import db as db_mod
+        from app.models import User
+        async with db_mod._session_factory() as s:
+            u = await s.get(User, 10)
+            assert u.email_digest_opt_in is False, "returning user re-enrolled"
+    asyncio.run(_check())