Send the account-bootstrap email

Deliver the verification email that POST /api/v1/accounts deliberately withheld. Public endpoint — the session id is the bearer secret, the same model as the poll route.

One session sends at most one message. The material backing the send is claimed atomically when the send is ATTEMPTED — so two concurrent calls cannot both deliver — and a failed delivery hands it back, returning email_sent: false so the call can be retried. A repeat after a delivered send answers 410.

This is not an anti-abuse measure and does not claim to be one: whoever is willing to make two requests is not stopped by it. Volume is bounded by the per-identity budget on the create call and by the recipient's own decline link. What the split removes is the case where creating a session and mailing a stranger were the same act.