Finish a signup with the code from the inbox

Signup creates the account but issues neither a session nor an API key until the address is confirmed, so registering under someone else's address gains nothing. This exchanges the six-digit code for a session. Unknown addresses, wrong codes and expired ones are answered identically, so this cannot be used to discover which addresses have accounts. Five wrong attempts burn the code.