v2.40.1 — subscription confirm and unsubscribe buttons work again

Drop-in patch. No new env vars, no migrations.

fix:

• The Confirm and Unsubscribe buttons on the emailed subscription pages work again. A no-referrer policy made browsers send Origin: null, so the CSRF check refused every click with err.origin.forbidden (#214, #215). Thanks to @gdecaso for tracking this down and sending the fix in #215.
• The per-address pending cap (5 unconfirmed subscriptions) now counts only the last 7 days and skips cancelled rows. Before, five never-confirmed requests locked an address out of email subscriptions for good (#216).
• A confirm link stops working once its subscription is cancelled, instead of showing "you're subscribed" again. Malformed confirm tokens are refused without a D1 read (#216).

chore: dev-dependency and CodeQL action bumps.