Claim Puzzle API and MCP

We send a link that works for 2 hours and signs in up to 3 devices. There's no password. We don't keep your address: a keyed hash of it identifies you, as it does for email reviews, and a sealed copy only we can open stays in your own sign-in cookie, so we can write to you about a claim or a report you ask for. Signing in sets a cookie that keeps you signed in on this browser as long as you come back at least once a week, until you sign out. It's the only cookie we set, and nobody who doesn't sign in gets one.