REST API Verification Needs an Email Lease

A backend pattern for giving verification emails an ownership lease, preventing duplicate claims, and keeping REST API retries safe.