New API endpoint secured by X-App-Secret header (no JWT auth required). Accepts an email in the request body and returns the user's id and stripeAccountId if present. Includes 6 unit tests covering all cases (success, missing secret, invalid secret, missing email, user not found). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>