NL-04: Welcome + latest-issue email for every new lead/optin (send-once, deduped)

- lib/welcome.ts: welcome email renderer (classic theme) + send logic with dedup on welcome_sent_at, skips suppressed/bounced/complained, honors SENDING_PAUSED - app/api/cron/welcome/route.ts: cron endpoint to batch-send pending welcomes (every 6h) - app/api/cron/sync-leads/route.ts: triggers welcome sends after new lead sync - app/api/subscribe/route.ts: fire-and-forget welcome on first-time optin - db/nl04_welcome_migration.sql: adds welcome_sent_at column, marks all existing subscribers as already welcomed (prevents historical blast) - vercel.json: registers /api/cron/welcome on 6h schedule Dedup: welcome_sent_at on newsletter_subscribers (unique email). Same email via lead AND subscribe = one send. Re-run sync-leads or re-subscribe does not resend. SENDING_PAUSED blocks this path.