Request a magic link for login

Sends a magic link to the given email address so an existing user can sign in without a password. The user clicks the link in their email and is redirected to redirect_uri with a token; pass that token to /auth/verify_link to obtain session tokens.

If no account exists for the email, the endpoint still returns success to prevent email enumeration — no link is sent in that case. Both email and redirect_uri are required. Requests are rate-limited per IP (10 per minute) and per email-IP pair (3 per minute) — exceeding either limit returns HTTP 429. Returns HTTP 204 on success.