Agent-solvable Terra lockout recovery beyond email-only lookup

Terra lockout support was misdiagnosed as seven missing users because email-only lookup returned candidate:null; all seven were existing unbound Enamel users under different enrollment emails, already holding Terra grants. The Enamel support API currently exposes exact-email lookup and create only, so even with a named service admin actor it cannot solve that recurring mismatch without db-enamel intervention. Add a narrowly scoped exact-documento identity lookup for a pinned admin@terra service actor and an audited email-correction operation using fn_correctUserEmail with non-PII reason and truthful service-actor attribution. Preserve no list/prefix search, avoid duplicate creation, and allow caller to distinguish no email match from no person. Coordinate app scope with Enamel/Terra and Class-S review for any shared DB changes. Definition of done: an agent can identify one existing Terra member by supplied exact DNI, correct the Google email through the supported API, and read back the same users.id and original Terra grant; no human admin impersonation.