Confirmation code must be 8+ characters

The API schema requires at least 8 characters before the row is touched.

POST /api/guardian/consent and POST /api/v1/guardian/consent reject shorter values. The emailed link includes a long base64url code.

An invalid or expired code stays on this page with Guardian confirmation link is invalid or expired.