Start email sign-in (link or code)

Sends a sign-in email containing both a link ({FRONTEND_URL}/signin/email#token=<tok>, the token lives only in the URL fragment, which keeps it out of the landing-page request URL and ordinary access logs — verification itself sends it to this API in a POST body, which the request logger does not log) and a six-digit code, both valid for 10 minutes. Returns 202 with an identical body for a known or unknown address — this endpoint never reveals whether an address has signed in before.

Disabled unless EMAIL_SIGNIN_ENABLED is set at boot (503 when disabled). Rate limited per address, per caller IP, and with a process-wide backstop; see internal/api/DECISIONS.md for the exact values. return_to is honored only when it matches the configured OAuth-bridge finalize prefix, mirroring /oauth/github/login's return_to handling.