Create the accounts, enrol everybody, and send each new student a link that sets their first password.

The response carries every activation link, deliberately. Schools hand these out on paper and at induction sessions as often as by email, and a school whose student addresses are aliases nobody reads is a real school — a coordinator who cannot recover the links is a coordinator waiting on 700 inboxes again, which is the thing this endpoint exists to end. It is owner/admin-only over TLS, which is the same footing as the email column on the People tab.