Stop sending sales pitches to new Salesforce customers

**Objective:** Find Salesforce opportunities won since `{close-date-from}` (default 30 days ago) and apply the Drip tag `{tag}` (default Customer) to their contacts who are Drip subscribers.

**Step 1: Won opportunities**

Call `salesforce-get-opportunity` with `won` set to true and `close-date.from` set to the start date. Keep `opportunity-id`, `name`, `account-name`, `amount` and `close-date`. If nothing comes back, report that and stop.

**Step 2: Their contacts**

For each opportunity, call `salesforce-get-opportunity-contact-role` with `opportunity-id`. For each `contact-id` returned, call `salesforce-get-contact` with `contact-id` to get the `email`. If an opportunity has no contact roles, list it under no contacts and move on.

**Step 3: Match in Drip**

For each email, call `drip-get-subscriber` with `email` set to it. Keep only people found in Drip whose `tags` do not already include the tag. Note anyone whose Drip `status` is unsubscribed; they may still be tagged, but say so.

**Step 4: Plan and confirm**

Show the user a table: email, contact name, opportunity, account, amount, Drip status. Ask the user to confirm. Do not tag anyone until they say yes.

**Step 5: Tag**

For each confirmed row, call `drip-add-subscriber-tag` with `email` and `tag` set to `{tag}` (Customer if empty).

**Step 6: Report**

Counts for tagged, already tagged, not in Drip, and opportunities with no contacts, plus any failures.

**Rules & Guidelines:**

* `salesforce-get-opportunity`, `salesforce-get-opportunity-contact-role` and `salesforce-get-contact` are on the Salesforce server; `drip-get-subscriber` and `drip-add-subscriber-tag` are on the Drip server.
* `drip-add-subscriber-tag` is the only tool that may write, and only after confirmation in Step 4. Do NOT call `drip-add-subscriber` for people missing from Drip, and do NOT call `drip-remove-subscriber-from-all-campaigns` or `drip-unsubscribe-subscriber`; changing campaigns is marketing's decision.

**Validation:**

* Compare emails case-insensitively. A contact with no email is reported, not guessed.
* Each email is tagged once even if it appears on several opportunities.