Confirm the code mailed by the request route.

DVT-5182. Checks the 6-digit code against the caller's newest pending code (5 guesses per code, 10 failed guesses per user per rolling 24 hours) and, on a match, stores the address as the caller's verified email. Errors: 400 email-verification-expired (no pending, unexpired code with guesses left; request a new one), 400 email-verification-code-mismatch (extension attemptsRemaining), 429 email-verification-rate-limited with Retry-After. Same guards as the request route. When a confirm replaces a different verified address, a notice (without the new address) is mailed to the previous one after the response is written, best-effort: a failed notice is logged and audited, never retried, and does not fail the confirm.