Validates the SMS code and returns a short-lived phoneVerificationToken required by POST /app-user/register. Also returns existingAccountsCount — the number of other AppUsers already using this MSISDN as recovery phone. The count is computed AFTER OTP possession is proven (so it is not an enumeration oracle) and is advisory only: signup is still allowed when the count is > 0 (legitimate cases: family-shared SIM, MNO-recycled number). The FE SHOULD render a soft "this number is linked to {N} other account(s) — did you mean to log in?" interstitial when the count is positive.

Access: Public endpoint.