Mint a guardian signing link.

same_device returns the path so the student can hand over their phone. email mails it. The student is the only possible sender either way: we hold no address for their parent, and the roster does not carry one.

A student could of course type their own address. That is not defended against here and cannot be; it is why a coordinator still verifies, and why the roster view shows the coordinator whether the signature arrived from the same device as the student's own session.

Takes NO db parameter: the transaction runs in _mint_sign_link on the threadpool and hands back plain values. See that function for why.