Enforce mute and quiet hours at the queue, require opt-in for reactivation

[ErikaOnFire]

Mute was only checked in the send path, so retries and background jobs could get around it. Moves the check to the queue, requires explicit opt-in before any reactivation send, and adds a one-tap unsubscribe that needs no login.

[github-actions]

HumaneBench · advisory

🟢 Clear

This change adds an opt-in gate for re-engagement notifications, enforces mute and quiet-hours at the queue level (not just the UI), and adds a frictionless one-tap unsubscribe path. No findings; the change strengthens user protections.

🟢 Adds a protection. Re-engagement messages now require explicit opt-in rather than default-on, converting what was likely a default-send into a consent-gated path. _{app/notifications.py}

🟢 Adds a protection. A tokenized one-tap opt-out that requires no login gives users a genuinely frictionless exit from notifications, consistent with the policy requirement that exit be frictionless. _{app/notifications.py}

---

_{🟢 clear   🟡 review   🟠 discuss   🔵 needs context. There is no red, because this check does not block anything. Scored against HumaneBench rubric v3.0, loaded verbatim, plus this repo's humane-policy.toml and the policy documents it names. Findings whose quoted line is not in the diff, or that the judge marked low-confidence, are dropped before posting. Deviations from v3 are in RUBRIC_DELTAS.md. Rubric daf4ecf, commit 000896e.}

_{Judged 10 Sep 2026, 19:27 UTC}