Email a one-time sign-in link. ALWAYS 200 with the same body for a well-formed address — known, unknown, suspended or not creatable alike.

RATE-LIMITED twice, both keyed on facts the caller already holds (the IP, the typed address), never on whether the address has an account — so a 429 is enumeration-safe: per IP on the shared auth limiter (a flood across many addresses), and per ADDRESS on its own limiter (a mail bomb aimed at one inbox, from many IPs).