Create a manual suppression

Creates a suppression with reason: manual_block and source: manual. Caller-supplied reason / source are ignored; scope is derived server-side from domain_id / from and is never trusted. Idempotent: if a matching row already exists (NULL-safe dedupe key: account_id, scope, to, reason, domain_id, from), returns the existing record with 200 (no new audit event).

bounce_category, dsn_code, meta, and group_id are not accepted on the public surface. Use the unsubscribe-group suppression endpoint or the internal create surface for those.