Allow Sends to be restricted to a list of email addresses. Recipients
request a one-time code by email through the `send_access` grant and
exchange it for an access token, matching the upstream flow.
- Store `auth_type` and `emails` on sends, with an additive migration
- One-time codes: single use, constant-time compared, invalidated after
5 wrong attempts, 60s resend cooldown, 5 minute validity
- Unlisted emails get the same response as listed ones and no email is
sent, so recipients can't be enumerated
- Access is gated on the stored auth type and fails closed when a Send
doesn't hold the emails or password its auth type requires
- Shared create/update handling of authType; it is inferred when
missing, like upstream, for clients that don't send it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>