Check a SponsorUnited email and password for the MCP sign-in

Called by the Cognito migrate-user Lambda with its own key (X-API-Key, MCP_SIGN_IN_API_KEY_TOKEN), which works on this endpoint only. Starts no session: no token, no session cache entry, no last-active write. Only 200 lets the user in. Every refusal (unknown email, wrong password, deleted, unverified, password reset pending, no use-mcp permission, no organization) is the same 401 {"error": "Invalid credentials"}; the reason goes only to the auth log. 401 {"status": "Invalid API key"} means the key is missing, wrong or another service's: a configuration error, not a user refusal. A few calls a minute per email (the Pro login retry limit) and an overall cap; the next gets 429 with Retry-After.