Bind Email Send

Mint + DELIVER an OTP to the target email for the caller to verify.

Pre-flight 409s if the email already belongs to a DIFFERENT account (the partial unique index would catch it at write time, but a clear 409 up front is friendlier). Re-verifying the SAME email the caller already owns passes through. Per-email 60s cooldown reuses the pending code (idempotent {sent:true}).