Verifies the OTP issued by POST /v1/auth/methods. On success returns the claim-eligible child organization's details plus a single-use claim token for POST /v1/account_claims/complete. Every challenge-verification failure returns an identical 422, so this step cannot be used to tell whether a claim is in progress for an email. Once the OTP is accepted the claim preconditions are re-checked and may answer 409 — the email gained a user, or the organization already has an owner — which discloses nothing, since reaching it requires the correct code.