get
https://api.qfp.quantnetwork.net/api/users/
Looks a user up by id alone. This is the one authenticated endpoint
that is not tenant-scoped: the caller's tenant_id claim is not
consulted, and no permission is required.
An id that matches no user is answered 200 with an empty body
rather than 404.
The endpoint requires Content-Type: application/json even though a
GET carries no body; a request without that header is answered 415.

