Stale contacts queued for re-verification, not deleted

Hard-deleting stale contacts destroys their suppression history. If the same email address reappears in a future import, the system treats it as a net-new contact with no prior history — re-adding it to the active list even if the person previously bounced or unsubscribed. This directly violates CAN-SPAM § 5's requirement to honor unsubscribes permanently (suppression history is the evidence of compliance). Under GDPR Art. 17, the right to erasure is separate from list removal: even when personal data is erased, a suppression record (email hash or similar) must be retained to prevent the address from being re-added in future imports.

Replace hard DELETE cleanup paths with status transitions that preserve the contact record and its suppression history:

-- Add status column if absent:
ALTER TABLE contacts ADD COLUMN status TEXT NOT NULL DEFAULT 'active'
  CHECK (status IN ('active', 'at_risk', 'inactive', 'lapsed', 'suppressed', 'pending_reverification'));

-- Stale cleanup: transition, never delete:
UPDATE contacts
SET status = 'pending_reverification'
WHERE last_engaged_at < now() - interval '180 days'
  AND status = 'inactive';

For GDPR Art. 17 erasure requests where personal data must be deleted, retain a suppression shadow: after erasing the contact record, insert a row in a suppression_list table with the email (or a hash) and reason gdpr_erasure. This prevents re-import of erased addresses without retaining PII beyond what is needed.