Email Send Code

Send a verification code via email.

Always returns 200 regardless of whether email exists — anti-enumeration. Passwordless auth means every valid request follows the same code path (generate, store, send), so timing does not leak account existence.

Email delivery is synchronous so that runtime failures (SES credential issues, transient AWS errors) surface as a 503 to the caller instead of silently succeeding while the code never arrives.