Check User Exists

Checks if a user with the given email exists in the database.

A self-serve account with no users row yet (waitlisted, or a setup that failed before creating one) still counts as existing: its Firebase identity is real, and blocking it here would strand the person before the sign-in that routes them back to their setup state.

Rate Limited: 10 requests per minute per IP address.

Security considerations:

• Rate limiting prevents automated user enumeration attacks
• Consistent response timing mitigates timing-based attacks
• All requests are logged for security monitoring

Does not require authentication - public endpoint for login flow validation.