Two-call flow with the same payload (only code differs). Empty code issues the OTP challenge to the current email. Populated code verifies the OTP and stages the email change — the new address is stored in email_confirmations with a 1-day expiry and a confirmation link is sent to it. The user's email is only swapped when the link is clicked.