Sends a custom email or SMS. There is no requirement that the recipient be the customer's own address/number — to is used as given. Gated by the customer's own email/sms notification preference (400 if opted out). Email/SMS send is fire-and-forget (not awaited) — a 200 response does not guarantee delivery, and if email.body is empty the send is silently skipped server-side while still returning success.