Add a scoped API user for the membership app

The user can read and manage subscribers on the eom.dev list only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

defaults/main.yml

@@ -72,6 +72,15 @@ listmonk_lists:
     description: >-
       One short email per premiere, plus the monthly essay. Nothing else.
 
+# API user for the www membership app (Authorization: token user:token).
+# It can read and manage subscribers on listmonk_api_lists only. Empty token:
+# no API user. listmonk caches API users at startup; the role restarts it.
+listmonk_api_user: membership
+listmonk_api_token: ""
+listmonk_api_role: Membership sync
+listmonk_api_lists:
+  - eom.dev
+
 # Drop the sample lists, subscribers and campaign created by --install.
 listmonk_remove_sample_data: true