Signup

Start the magic-link signup flow.

1. Validate the email against the Company-Email policy (G-014).
2. Idempotency: if this email already has an unexpired attempt (within the 15-minute TTL), do nothing and return the same success response — never spam a second email.
3. Otherwise: generate a fresh 32-byte token, store its SHA-256 hash in Postgres (durable) and Redis (hot lookup with TTL), and dispatch the email.

Always returns the same success message regardless of whether a new email was sent — keeps the response side-channel-free for enumeration attempts.