Two-call flow with the same payload. Empty code validates the payload and issues an OTP challenge — response has data.type = "challenge" and carries expiration_at/resend_at/factor. Populated code re-validates, verifies the OTP, applies the new password, and returns fresh tokens — response has data.type = "jwt". Both flows return 201; clients discriminate on data.type.