auth: subscribe-to-digests checkbox on verify (default on)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/routers/auth.py

@@ -216,6 +216,7 @@ async def verify_page(request: Request, error: str | None = None, sent: str | No
 async def verify_submit(
     request: Request,
     code: str = Form(...),
+    subscribe_to_digests: str | None = Form(default=None),
     session: AsyncSession = Depends(get_session),
 ):
     cookie = request.cookies.get(PENDING_COOKIE_NAME)
@@ -240,6 +241,8 @@ async def verify_submit(
         # User row vanished between cookie issue and verify. Restart flow.
         return RedirectResponse(url="/login", status_code=303)
     user.last_login_at = utcnow()
+    # An unchecked HTML checkbox sends NO field; that means "opt out".
+    user.email_digest_opt_in = subscribe_to_digests is not None
     await session.commit()
     log.info("user.login", user_id=user.id, email=email)
 

app/templates/verify.html

@@ -32,6 +32,12 @@
                minlength="6" maxlength="6" required autofocus
                style="font-family:var(--font-mono); letter-spacing:0.4em; text-align:center;">
       </label>
+      <label style="display:block; margin:14px 0 0; font-size:12.5px; color:var(--muted); line-height:1.55;">
+        <input type="checkbox" name="subscribe_to_digests" value="on" checked
+               style="vertical-align:middle; margin-right:6px;">
+        Email me the digest — daily for paid, Sunday for everyone.
+        One-click unsubscribe in every email.
+      </label>
       <button type="submit">Verify</button>
     </form>