Security: Prevent bot-forced Mailchimp subscriptions from /api/signup/

[ddfridley]

Problem

The current signup flow can subscribe users to Mailchimp before email ownership is verified.

• /api/signup/ accepts public POSTs and triggers SubscribeToMailingList(...) when newsletter_signup is set.
• The Mailchimp helper uses status: "subscribed" (immediate subscription), not a pending confirmation flow.
• Signup has CSRF protection, but no explicit anti-bot control on this route (captcha/challenge or dedicated server-side rate limiting for this endpoint).

Risk

Bots can create accounts using third-party email addresses and force unsolicited newsletter subscriptions. This creates abuse/compliance risk and can degrade sender reputation.

Suggested solution

1. Delay newsletter subscription until email is verified.
2. Change Mailchimp member creation to status: "pending" (double opt-in behavior).
3. Add anti-automation controls to signup:
   • server-side captcha verification (or equivalent challenge), and/or
   • endpoint-level rate limiting by IP + email fingerprint.
4. Replace per-request thread spawn in Mailchimp helper with background queue/job processing.
5. Reduce PII in error logs for failed Mailchimp calls.

Acceptance criteria

• A new account with newsletter_signup=true is not subscribed until email verification succeeds.
• Mailchimp receives pending status and user must confirm via email.
• Repeated bot-style signup attempts are throttled/blocked.
• No raw email addresses are emitted in Mailchimp error logs.