Email a single-use onboarding magic link to a provisioned IdP user

Mints a single-use onboarding-link token for a provisioned IdP user who has no reusable MFA factor yet and EMAILS a magic link to the user's secondary/recovery email, so a brand-new device can bootstrap first-device passwordless IdP onboarding. This is the PREFERRED first-device path; the onboarding-password endpoint is the admin-relayed fallback. The token is never returned in the response — it lives only inside the emailed link (only its digest is stored). Requires an organization administrator (RBAC). Returns 404 when the user is not a provisioned IdP user (no existence leak), 409 when the user already has a reusable MFA factor, and 409 when the organization has no identity-provider application configured or more than one (ambiguous).