Unauthenticated. Validates email + current password (which must already be expired), optionally validates a candidate new password, and issues an email OTP. When new_password is empty the response is bound to the waive branch; when populated, to the update branch. Returns 201 with data.type = "challenge" carrying expiration_at/resend_at/factor.