Add privacy-aware per-recipient export and erasure controls

Problem/Motivation

Raw payloads are correctly not stored and watchdog recipients are redacted, but the database retains full addresses and provider free-text descriptions. Cron is the only lifecycle tool; it cannot express per-recipient access/export or differentiated retention.

Evidence and scope

Reviewed 1.0.0-alpha1, source commit 02fd9d36af5237e712cecb7155d79725f7824880. Location: postmark_webhooks.install:41.

Observed data model. This is a product/data-minimization improvement, not a claim of a specific legal compliance failure.

Proposed resolution

Define the minimum evidence needed for suppression, assess dropping or sanitizing provider descriptions, and provide permission-controlled export/erasure operations. Make explicit whether a minimal suppression marker must remain so deleting history does not accidentally resume unwanted mail.

Acceptance criteria

Test permissions, audit records, export escaping and secret exclusion. Document how durable suppression and history erasure interact, including backups and operator policy; do not promise irreversible erasure of external systems.