Per-email tracking override on /v1/send

[chamby]

Is your feature request related to a problem?

We have transactional sends where we need to guarantee that no open/click data reaches AWS for specific emails (privacy requirement). TrackingMode covers this at the project level, and MARKETING_ONLY gets close, but there's no way to control tracking for an individual send — e.g. keeping tracking on for most transactional mail while disabling it for a sensitive subset.

Describe the solution you'd like

An optional tracking boolean on POST /v1/send:

• Omitted → project TrackingMode applies exactly as today
• false / true → overrides the project mode for that email only

Persisted as a nullable trackingOverride column on emails so the worker sees it at send time, feeding the existing config-set switch in SESService. Same constraint as MARKETING_ONLY: only effective when SES_CONFIGURATION_SET_NO_TRACKING is configured.

I have a PR ready implementing this (schema + migration, Zod, EmailService, OpenAPI spec, tracking guide, tests) — will link it here.

One design question for you: when tracking: false is passed but the instance has no no-tracking config set, the override is silently ignored (consistent with how MARKETING_ONLY behaves today). Happy to add a response warning instead if you'd prefer.

Alternatives or workarounds

• An internal header (X-Plunk-No-Tracking) read and stripped in EmailService, like X-Plunk-Recipient-Override — no migration needed, but undiscoverable and not validated, so a first-class field seemed like the better API. Can rework the PR that way if you prefer.
• Splitting sends across two projects with different tracking modes — workable but clumsy.

Additional context

This issue and the accompanying PR were prepared by Claude (AI assistant) acting on behalf of Matthew Chambers (@chamby), who reviewed the approach.