Issue or refresh a session

The only unauthenticated write route in the API. Rate limited per IP *and* per email, counted separately: per-IP alone lets a botnet spread an attack on one account, per-email alone lets one host lock out every account it can name. A failure is deliberately indistinguishable from any other failure — same shape, same message, and a hash comparison that runs even when the account does not exist, so the response time does not reveal whether an address is registered.