Sends a one-time code to an address for the calling email-less (`anonymous`) key. Nothing changes until the SAME key sends the code back to `POST /v1/keys/self/email/verify`; meanwhile `GET /v1/keys/self` shows the address as `pending_email`. Sending again (a corrected address, or a resend) replaces the pending address and voids the earlier code.

Quota-free like the rest of /v1/keys/self, and capped at [identity::MAX_EMAIL_ADDS_PER_KEY_PER_DAY] per key and [identity::MAX_EMAIL_ADDS_PER_IP_PER_DAY] per IP (an IPv6 /64 counts as one) per UTC day, and at the per-network plus per-address mail budget every signup already has. Unlike signup, a spent mail budget is a 429 here: no code is minted that was not mailed, so the budget also caps the codes anyone can guess at for one mailbox.

The answer is the same whether or not the address already has an account: a code is mailed either way, and only redeeming it (which takes the code from the mailbox) can tell.