Resolve Import Contacts

Resolve browser-import candidates through the canonical identity policy.

The authenticated org is the only scope accepted. Unmatched or ambiguous candidates are omitted so the browser can continue its existing insert flow; returned matches are safe to treat as existing Contacts.