Self-serve account lookup for the dashboard (v4.0 W5, §3.3 onboarding).

AUTH IS DELIBERATELY DIFFERENT from every other /v4/* route. This is the ONE endpoint a user hits BEFORE they possess their operator key (it is how they retrieve it), so it CANNOT use _auth() (which resolves the operator key). It instead authenticates the caller's Supabase Auth session: the dashboard sends the user's Supabase access token as the Bearer, we validate it against Supabase (gotrue), take the VERIFIED email off the session, and return that tenant's row.

Returns ONLY the caller's own account metadata — operator key, subscription status, auto-fire threshold. It never touches leads/missions/prospects, so no scoring/IP is exposed and no RLS is required: the pipeline stays agentic (the MCP agent is the pipeline UI), this is purely the key-delivery + account surface.

404 (not 401) when the Supabase email has no users row yet — i.e. the person authenticated a magic link but never completed Stripe checkout. The dashboard shows a "subscribe to get your key" state on a 404.