Send a Confirmation Code

Requires permissions: Guardian or NewJoiner or Parent or Student

Emails or texts a one-time code to the address or number the caller is changing to. Rate-limited per destination AND per caller (the caller cap is the binding one; the endpoint throttle keys on a client-supplied header and is defence in depth only). Always answers 200 — whether a code was sent is in the body, so the endpoint cannot be used to probe which addresses exist.