Our sign-in page proves the person and asks for an app's one-time code, unauthenticated

Requires X-Six-Minute-Page: 1 from an Origin this service serves (403 otherwise). Proves the person by the emailed code (method: email, with the email verify route's limits and refusals) or by WorkOS's code with the page's own verifier (method: workos, a wrong verifier is 422 invalid-code). Answers an sma_ code that works once, for 60 seconds, at POST /v1/auth/token with the verifier of code_challenge for client. A person nobody invited is 403 no-firm; one in several firms gets a code all the same, and the token endpoint answers the choice. Rate limited per caller.