Get a single ACTIVE user's full admin profile by ID, email,
or name. Deactivated users surface as not found in this
phase. Returns id, names, email, department, manager,
custom_properties, locale, time_zone, hired_on, and
last_active_at, plus three role-related fields the caller
must not conflate: role (coarse "admin" / "employee"),
company_admin (legacy single-flag), and permission_names
(humanized fine-grained admin capabilities). When the
identifier is ambiguous, returns a disambiguation payload
listing candidates so the caller can re-issue the request
with a chosen ID. Admin-only — gated on the same policy
as the Bizy chat UserAdmin agent.

Required OAuth scope: user:administer