S7 (a1): newsletter — THE VYNDR REPORT

Email capture + daily report assembly + operator-triggered Listmonk send.

- NewsletterCapture (dark terminal, mono) on landing (below FAQ) + /welcome
  (the real signup success surface); double-opt-in note; 'Signups open soon'
  when Listmonk env is unset.
- POST /api/newsletter/subscribe: public, 10/min IP limit, honeypot,
  server-side email validation, forwards to Listmonk subscribers API with
  preconfirm_subscriptions:false (Listmonk sends the confirmation).
  No env -> calm 200 { ok:false, reason:'not configured' }. Next proxy
  web/src/app/api/newsletter/subscribe/route.ts (S25 rule).
- newsletterService.buildDailyReport: signals from snapshot:{sport}:latest,
  STREAK WATCH via rosterLogs -> streaksService -> streakLens, THE RECORD via
  ledgerService.getModelAggregate (percentage only when hit_pct != null —
  n>=20 gate — else 'RECORD BUILDING · N pending'). RG footer (21+,
  1-800-GAMBLER, Listmonk-native {{ UnsubscribeURL }}) in html + text.
  VOICE v1.1 lint locked by tests: no '!', no banned vocabulary, numbers
  only from injected pipeline data.
- sendDailyReport: creates + starts a Listmonk campaign; env-gated no-op;
  refuses an empty report. Deliberately UNSCHEDULED — only
  POST /api/internal/newsletter/send (internal key) triggers it.
- docs/NEWSLETTER.md: box-side Listmonk runbook (install, double-opt-in
  list, API user, Coolify env, test-send).
- Spec: specs/feature-a1-s7-newsletter.md.

Tests 2398 -> 2429 (207 suites, all green); next build exit 0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/app.js

@@ -182,6 +182,9 @@ app.use('/api/books', bookComparisonRoutes);
 // generated from live data, degrading gracefully by data level.
 const contentRoutes = require('./routes/content');
 app.use('/api/content', contentRoutes);
+// Session S7 (a1) — THE VYNDR REPORT: public double-opt-in subscribe
+// (forwards to the self-hosted Listmonk; graceful no-op without env).
+app.use('/api/newsletter', require('./routes/newsletter'));
 // Session 18 — internal ops endpoints (admin dashboard triggers,
 // shared-key auth via `VYNDR_INTERNAL_KEY`). Never reachable from
 // the public surface; the Next.js admin route proxies through with