Sends a one-time SMS code to the supplied MSISDN. The code can then be exchanged at POST /app-user/auth/recover/username/verify for a non-enumerating delivery confirmation; username recovery results are sent by SMS, never returned in the API response. The endpoint deliberately returns 200 regardless of whether any AppUser is linked to the MSISDN — silence-on-miss prevents enumeration. Rate-limited per-MSISDN with the same cooldown contract as /register/phone/request (default 60s, env-tunable via PHONE_OTP_COOLDOWN_SECONDS). Cooldown namespace is separate from signup so users mid-signup are not locked out of recovery.

Access: Public endpoint.