Use indexed WorkOS lookup for admin user emails

[maschwenk]

Summary

• resolve cloud admin email filters with one WorkOS listUsers request scoped by both organization and normalized email
• avoid listing every membership and fetching users sequentially in production
• retain the membership-backed scan only for the configured test/dev WorkOS emulator, which does not expose the list-users route

Why

The reverse directory resolver currently lists every organization membership and calls getUser until it finds a matching email. Its latency therefore grows with organization size and the matching member's position. WorkOS accepts organizationId and email together, providing a single indexed lookup without weakening tenant isolation.