Look up a user by email address when the internal user ID is not known. Since email is unique, the response contains at most 1 item. Returns an empty array when no match is found.

🔒 External clients call this endpoint with an OAC (Organisation Access Credentials — ⚠️ Beta) access token carrying the users:read scope.