Console sign-in

People sign in to the Console with an e-mail link. There are no passwords. Programs keep using API keys.

Route	What it does
`POST /v1/auth/email {email}`	Sends a sign-in link (one use, 15 minutes). The answer is the same for every address
`POST /v1/auth/email/verify {token}`	Signs in: sets the session cookie and returns `csrf`, the team and the role. A new address also gets its own team
`POST /v1/auth/mfa {code}`	With 2FA on: the authenticator code (or a backup code) completes the sign-in
`POST /v1/auth/totp {action: begin \| confirm \| disable, code}`	Turns 2FA on (shows the secret, then 10 one-use backup codes) or off
`GET /v1/auth/me`	The person, their teams and roles, 2FA on / off
`POST /v1/auth/switch {tenant}` · `POST /v1/auth/logout {everywhere}`	Another team · sign out (here or everywhere)

Every write from the Console sends the X-Prism-CSRF header (the csrf value from the sign-in). Without it: 403.
Roles: owner and admin may do everything; developer: read, write, import; viewer: read.
Team: GET /v1/auth/team (members: role, 2FA, last active + open invites) · POST /v1/auth/team {action} (owners, admins): invite {emails, role} (an existing account joins now; a new address is e-mailed and joins on its first sign-in), role {account, role} (only an owner makes or changes an owner; never the last owner), remove {account} (their sessions for the team end), cancel_invite, resend_invite {email}, remind_2fa {account}.
Security: GET /v1/auth/sessions (where you are signed in: device, address, current) · POST /v1/auth/sessions {action: end, id} or {action: others} · POST /v1/auth/totp {action: codes, code} makes 10 new backup codes · GET|POST /v1/auth/team2fa {on} (owners, admins): everyone must sign in with two steps; a member without it has 7 days, then reaches only the screens that turn it on (403).
Wrong keys: an address that sends more than 30 wrong keys or tokens in a minute gets 429 + Retry-After before any key is checked.
During testing, sign-up is by invitation only (the operator runs allow-signup <email>).