Email Login

Verify the OTP and return {token, user}.

Existing-account only — unknown emails get the generic "no pending code" error so the endpoint can't be enumerated. Inactivated accounts are also rejected here (the activation flow is still the only way to flip is_active=1).