docs: email should be hex-encoded UTF-8, to avoid ambiguity

If we sent it as raw unicode, then it would get encoded by the HTTP
agent, decoded by the server's HTTP stack, then delivered through who
knows what to the IDP application code. Each step is an opportunity for
something to go wrong and mangle the string, which would break the
key-derivation being done by both sides. It's safest to encode it
exactly once, at the beginning, according to our API spec, and send only
boring ASCII over the wire.

Conflicts:
	docs/api.md
clarify docs: single-use tokens are consumed by failure too
docs: mark the two calls that fail unless the account email is verified