Resend e-mail confirmation link (unauthenticated)

Re-issues the e-mail confirmation link for an account that has not been confirmed yet. Unauthenticated — intended for the "forgot password" screen, so a user whose confirmation e-mail never arrived can ask for another one instead of needing an administrator. Whatever the state of the account, the response is the same `202`: it does not reveal whether the address belongs to an account, nor whether that account is already confirmed. An already-confirmed or soft-deleted account is a silent no-op and sends no e-mail. Each address may trigger at most one send per 5 minutes; a request inside that window answers `429`. The cooldown slot is taken before the account is looked up and for every address, so `429` says only "this address was asked about recently" and never "this address has an account". Re-issuing invalidates the previously mailed link.

curl -X POST "https://example.com/api/v2/auth/resend-confirmation" \  -H "Content-Type: application/json" \  -d '{    "email": "customer@example.com"  }'