Result of [create_or_reuse_pending]: the session id to hand the client,
and the freshly minted token when a new message must be sent. A reused
session yields None, signalling no new mail.
Third-party identifier (email) storage and the requestToken throttle. Holds
the forward (user, email) bindings, the reverse email -> user lookup,
the pending email verification sessions, and the per-IP and per-address
token buckets.
Canonicalize an email address for storage and matching: case-fold the
whole address and lower-case the domain. This is stronger than
str::to_lowercase, which leaves Γ intact; case-folding maps it to ss
so StrauΓ@Example.com and strauss@example.com collide on one key.