Fix quiz-lead wiping lists and attributes of existing subscribers

PUT /api/subscribers/{id} with lists=[quiz] replaced all lists and attribs:
a Press reader taking the quiz dropped out of Press, buyers lost course and
updates_until, status "enabled" lifted blocklisting. Verified on Listmonk 6.2.

Now: add to the quiz list via PUT /api/subscribers/lists (action add), write
attribs with current lists and status and preconfirm_subscriptions=false,
leave blocklisted subscribers untouched, keep first-touch utm_*.

Bot protection: constant-time secret check, quizzes faster than 20 s are
dropped silently, global hourly cap and per-email cap, strict email check
(the address goes into a Listmonk SQL filter), result email at most once a
day per address. Quiz v2 fields: quiz_type, quiz_date, quiz_answers,
quiz_utm, optional result email through LMS (send_result). v1 bot payload
keeps working.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -37,6 +37,11 @@ LISTMONK_URL="https://newsletter.second-brain.ru"
 LISTMONK_USER="apiuser"
 LISTMONK_TOKEN=""
 LISTMONK_QUIZ_LIST_ID=""
+# Квиз v2: письмо-результат через LMS (tx-шаблон с ветками по quiz_type); пусто — LMS писем не шлёт
+LISTMONK_QUIZ_TX_TEMPLATE_ID=""
+QUIZ_RESULT_FROM="Second Brain <delivery@mailsend.second-brain.ru>"
+# Защита от ботов: потолок лидов квиза в час (по умолчанию 60)
+QUIZ_LEAD_MAX_PER_HOUR=""
 
 # Freemium gate: ID wow-урока (2.6 «ежедневные заметки») — после его завершения
 # показываем лестницу-оффер (трипвайр + полный курс)