Send the Send verification email in the background

Sending the code only for allowed emails made those responses take as
long as the SMTP round trip, which tells allowed and unknown emails
apart. Mail the code in the background so both answer the same way.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/auth/send.rs

@@ -156,12 +156,14 @@ impl SendTokens {
         let Some(code) = otp.map(|o| o.trim().to_owned()).filter(|o| !o.is_empty()) else {
             if stored.as_ref().is_none_or(SendAccessOtp::can_resend) {
                 let code = crypto::generate_email_token(CONFIG.email_token_size());
-                let new_otp = SendAccessOtp::new(send.uuid.clone(), email.clone(), code.clone());
+                SendAccessOtp::new(send.uuid.clone(), email.clone(), code.clone()).save(conn).await?;
-                new_otp.save(conn).await?;
+                // Mail in the background, so neither the response time nor a mail failure tells listed
+                // and unlisted emails apart. On failure the recipient can request a new code after the cooldown.
+                tokio::spawn(async move {
                     if let Err(e) = mail::send_send_access_otp(&email, &code).await {
-                    new_otp.delete(conn).await.ok();
+                        error!("Failed to send Send verification code: {e:#?}");
-                    return Err(e);
                     }
+                });
             }
             return Self::expected_error("Email and OTP required", "email_and_otp_required");
         };