NL-04 fixes: use after() for reliable welcome send, add tests + runbook

- app/api/subscribe/route.ts: replace fire-and-forget with after() from next/server — uses waitUntil on Vercel so the welcome send survives the serverless lifecycle - Add vitest + 8 tests for welcome dedup contract, unsub tokens, send guard - docs/NL-RUNBOOK.md: complete copy-paste runbook for all three tasks (NL-02/03/04) with DRY_RUN, live commands, migration verification, DNS checks, and DONE WHEN proofs