sendCode
The default sendCode for the AuthGatePlugin: deliver the OTP through
the host app’s ALREADY-PRIMED @dbx-tools/email transport, as the system
sender (a verification code is machine-generated and unanswerable, so it must
not arrive from a person’s address inviting a reply).
@dbx-tools/email is an OPTIONAL dependency of the tunnel - a tunnel used
without the gate needs no mail. So it is imported LAZILY here; a missing module
surfaces only when a gate actually tries to send a code, and
ensureEmailAvailable turns that into a clear fail-fast at boot.