Document the token and status-code contract per flow, and unify terminology

[Bccorb]

Context

Surfaced during a usability survey. Related to the new docs/direct-http-quickstart.md, but broader.

Gaps:

• No single reference for which endpoint returns which token (ephemeral vs access vs refresh) and what claims each carries.
• Branch-significant status codes are not documented per flow (e.g. magic-link poll 204 = not yet verified vs 200 = verified). The SDKs branch on these exact codes, so they are part of the contract.
• Terminology drifts between "identifier" and "email"; clarify how phone identifiers are supplied at /login.

Suggested work

• Add a token/flow contract section (or doc) mapping endpoints -> tokens -> claims -> notable status codes.
• Normalize identifier/email wording across README and docs.

Acceptance

• One authoritative place describing per-flow tokens and status codes; consistent terminology.