Proves the address: the calling email-less key sends back the code `POST /v1/keys/self/email` mailed. On success the address becomes this key's account's, and THIS key, and only this key, is lifted to `verified` on the free tier, which also unlocks offline downloads.

Only the key that asked for the code can redeem it. An address that already has ANY identity row is NEVER attached, whether or not anybody ever verified it, and nothing moves between identities: the answer is 409 email-in-use. The app should then sign in with that address through POST /v1/keys, which the owner's own mailbox verifies; that is a new key on the address's identity, so the email-less key's own state (its usage, styles and jobs) does not come with it. A wrong code counts against [identity::MAX_EMAIL_CODE_ATTEMPTS] (then the code is void), and attempts are capped per key and per IP per day like every other verification budget.