Email the user a sign-in code

Send a magic link and a six-digit code to the user's email. The user reads the code from their own inbox and gives it to the client — that human-in-the-loop step is deliberate. New accounts receive a one-time grant of free API tokens on first sign-in (see GET /v1/plans on api.close.city). Rate-limited per email address and per IP.