Look up which sign-in path an email address needs

No authentication. Drives the second step of the stepped login.

• Rate limit, checked before the body is parsed: more than 15 requests within 60 s from one client IP answer 429. The IP is the first x-forwarded-for entry, else x-real-ip, else the shared bucket unknown. The limiter is in-memory per server instance, and rejected requests count toward the window.
• email is normalized with String(email ?? '').trim().toLowerCase(); a non-JSON body answers 400 Invalid request, an empty or malformed email (^[^\s@]+@[^\s@]+\.[^\s@]+$) 400 Invalid email.
• The users lookup and the external-auth listing run with the PocketBase superuser client (getAdminPb, POCKETBASE_ADMIN_EMAIL / POCKETBASE_ADMIN_PASSWORD).
• new: no account with this email. oauth: the account is linked to Google and/or Apple. password: any other account. Every backend failure (including the superuser login) also answers password, so this operation never returns 500.