[Adron]

Closes #89. Part of epic #87.

The link URLs were established, not guessed

Probed the way #72 did:

URL	Result
GET /api/blog/subscribe/confirm?token=probe	307 → /blog?subscription=invalid
GET /api/blog/unsubscribe?token=probe	307 → /blog?subscription=invalid
/blog/confirm, /blog/subscribe/confirm, /blog/unsubscribe, /unsubscribe, /confirm-subscription	all 404

The emails point straight at the API routes, so those two paths are what the intent filter claims.
(Independently re-verified: the confirm probe returns 307 to …/blog?subscription=invalid.)

POST /api/blog/subscribe {"email"} → 200 {ok, message:"Check your email to confirm your subscription."} for any valid address regardless of state (enumeration-safe);
400 {"error":"A valid email is required","code":"bad_request"} otherwise.

Double opt-in is stated before and after

A successful subscribe lands in CHECK_YOUR_EMAIL, never a "subscribed" state: "We've sent a
confirmation link to address. You are not subscribed yet… Nothing will arrive until you do." There
is deliberately no success state that looks finished — that is the failure mode the issue warns about.

Both emailed links are handled in-app: the app calls the endpoint and shows the outcome. The token
endpoints go through an OkHttp client with followRedirects(false), because the 307's Location
(subscription=confirmed|unsubscribed|invalid) is the entire result — following it would fetch
the blog's HTML and throw the answer away. An unrecognised redirect maps to invalid, never to success.

BlogLink was extended, not duplicated. A recognised link with a blank or missing token still
parses and is reported as unusable without a network call — the app claims those URLs, so silence
would be the worst outcome.

One thing that could not be done as literally specified

There is no address-only unsubscribe. Item 3 asks for POST /api/blog/unsubscribe and item 5 says
not to implement RFC-8058 — live, those are the same endpoint. It was probed six ways (?token=,
{"token"}, {"email"}, form-encoded, malformed JSON, List-Unsubscribe=One-Click, and bare):
every one returns a bare 200 with no body. It acts only on a valid emailed token and never reports
anything. A button wired to it could only pretend to work.

So the form points at the unsubscribe link in any blog email — which the app now opens itself — and
the unsubscribe path uses the informative GET. One-click unsubscribe stays a mail-client concern.

Verification

./gradlew clean :app:assembleDebug testDebugUnitTest → BUILD SUCCESSFUL, 1474 tests, 0 failures
(40 new in :app). Coverage: deep-link parsing including near misses (/api/blog/subscribe, a deeper
path, /unsubscribed, /unsubscribe-all, look-alike hosts, the un-prefixed 404 paths, garbage); route
mapping and token percent-encoding; a MockWebServer round trip asserting the exact body
{"email":"reader@example.com"}, the 400 and 500 paths, that the redirect is not followed
(requestCount == 1), and that a rejected token surfaces as invalid.

No real subscribe request was sent for a valid address — nothing was changed on the live mailing
list; only 400-ing and token-rejecting probes were issued.

⚠️ Pre-existing infrastructure gap found — filed separately

https://interlinedlist.com/.well-known/assetlinks.json returns 404 (verified). App Links
verification therefore cannot succeed, so the pre-existing autoVerify https intent filter — which
already carries /reset-password, /verify-email and the email-change paths — will not auto-open
for any of them on Android 12+. The two blog paths inherit that. Not introduced here and not fixed
here; the interlinedlist:// custom-scheme equivalents work regardless.

Other notes

• Not covered by an automated test: navigating to the bare blog/subscription route with both
  optional query args omitted. It is Navigation's documented optional-argument mechanism (mirroring
  AuthRoutes.RESET/EMAIL_CHANGE), but no existing route in this repo is navigated with its args
  omitted, and there is no emulator. Worth one tap when someone next runs the app.
• No Compose case was added to :feature:profile's ProfileScreenTest.kt for the new menu row (Blog: reach the blog from the app #88
  added one for its row) — a second file in that module, outside scope, and androidTest cannot run here.

[Adron]

Merged into parity/queue. Three-file conflict with #29 (tag feed) resolved on the way in — MainActivity and InterlinedListNavHost each gained a new deep-link route, and both branches rewrote the manifest's App Links comment. All routes kept; MainShell's notificationRoute parameter had already been folded into pendingRoute by #29, so this PR's onOpenBlogEmails was grafted onto that signature. Re-verified with a full --rerun-tasks build: :app:assembleDebug testDebugUnitTest green, and the merged manifest carries all nine data paths.