Verify an email sign-in link or code

Accepts exactly ONE of two bodies: {"token": "..."} (the link's fragment token) or {"email", "code"} (the six-digit code). Every failure case — unknown, expired, wrong code, already consumed, locked out after 5 wrong attempts, or malformed — returns the identical 401 body, so a caller cannot distinguish them. There is no GET route for this endpoint — a link scanner or prefetcher that merely opens the emailed link cannot burn the challenge.

On success returns redirect_to, the same shape /oauth/github/callback produces: either the dashboard's /callback?code=... or, if the original start call's return_to is still valid against the OAuth-bridge finalize prefix, that URL with ?code=... appended.