Email suppression list

Recipients the dispatcher will skip. Active rows are dropped from to_addresses before the driver call; if every recipient on a row is suppressed the outbox row is cancelled rather than failed. Lifting a row stops the suppression immediately — the dispatcher's partial index is keyed on active = true.