feat: Brevo double opt-in + contact sync

- Add brevo.py: transactional email sending + contact list sync via Brevo API
- Add token.py: stateless HMAC-signed confirmation tokens (no DB migration needed)
- Update routes.py: POST /waitlist sends confirmation email, GET /waitlist/confirm verifies token
- Update config.py: Brevo + confirmation settings (gracefully disabled when BREVO_API_KEY is empty)
- Update .env.example with new Brevo and confirmation variables
- Add httpx dependency
- Add 8 new tests (token roundtrip/expiry/tamper, confirm endpoint, Brevo mock)

requirements.txt

@@ -8,3 +8,4 @@ pydantic>=2.0,<3.0
 pydantic-settings>=2.0,<3.0
 email-validator>=2.0,<3.0
 python-dotenv>=1.0,<2.0
+httpx>=0.27,<1.0