Email Send

Mint + send a 6-digit OTP to payload.email.

Anti-enumeration: the response is identical whether or not the address belongs to a registered, activated user. We still skip the Resend call (and the per-account quota burn) for missing / unactivated accounts — there's no point delivering codes nobody asked for — but the caller can't tell from the response.

Rate limits mirror /api/auth/sms/send:

• per-email cooldown: 1 OTP / 60s. Within-window requests reuse the existing code (no fresh send) but return {sent:true}.
• per-IP cooldown across emails: 1 send / 60s / IP, to stop a single attacker from sweeping the table.