Redeem the emailed 6-digit code for a reveal-once workspace API key.
UNAUTHENTICATED. `email` + `code` must match a code issued by signup(email)
within the last 15 minutes (5 attempts max). The returned `api_key` is shown
exactly ONCE — store it ONLY in the MCP client config
("Authorization: Bearer <api_key>"), NEVER in a repo or a file you might
commit. Then reconnect this server with the header set and call
get_onboarding_status(). An invalid/expired/consumed code returns a uniform
error — call signup(email) for a fresh one.
ConnectorNo auth