Send a sign-in code and link by email

The answer is the same for new and existing addresses, and also when the address got too many emails: then no email is sent. An account is created after the first confirmed sign-in; the first sign-in to an account whose email was never confirmed signs out its sessions and devices, removes its password and phone number, disconnects its apps, and in workspaces nobody else uses revokes the API keys, turns off webhooks and Supabase hooks and signs out and pauses WhatsApp numbers; in shared workspaces it revokes the keys this account created and turns off the webhooks and hooks it or nobody known created. GET /me then shows access_reset until it is acknowledged. Sets the otprun_email_challenge cookie that the code check needs. A browser with the otprun_device cookie of this address skips the daily limit of the address. A new email closes earlier ones only when it comes from the same browser or network. Answers 429 only when one network sends too many requests and 503 with code unavailable while email sign-in is turned off.