Fix exact email grants and clarify cloud and wind labels

scripts/grant_subscription_by_email.py

@@ -14,22 +14,47 @@ if PROJECT_ROOT not in sys.path:
     sys.path.insert(0, PROJECT_ROOT)
 
 
+def _select_exact_user_id(payload: object, email: str) -> str:
+    from src.payments.contract_checkout import PaymentCheckoutError
+
+    normalized_email = str(email or "").strip().lower()
+    users = payload.get("users") if isinstance(payload, dict) else None
+    if not isinstance(users, list) or not users:
+        raise PaymentCheckoutError(404, f"supabase user not found for email={email}")
+
+    matches = []
+    for row in users:
+        if not isinstance(row, dict):
+            continue
+        row_email = str(row.get("email") or "").strip().lower()
+        user_id = str(row.get("id") or "").strip()
+        if row_email == normalized_email and user_id:
+            matches.append(user_id)
+
+    unique_matches = []
+    for user_id in matches:
+        if user_id not in unique_matches:
+            unique_matches.append(user_id)
+
+    if len(unique_matches) == 1:
+        return unique_matches[0]
+    if len(unique_matches) > 1:
+        raise PaymentCheckoutError(
+            409,
+            f"multiple exact supabase users matched email={email}: {unique_matches}",
+        )
+    raise PaymentCheckoutError(404, f"exact supabase user not found for email={email}")
+
+
 def _lookup_user_id_by_email(email: str) -> str:
-    from src.payments.contract_checkout import PAYMENT_CHECKOUT, PaymentCheckoutError
+    from src.payments.contract_checkout import PAYMENT_CHECKOUT
 
     payload = PAYMENT_CHECKOUT._auth_admin_request(  # noqa: SLF001
         "GET",
         f"/admin/users?email={email}",
         allowed_status=[200],
     )
-    users = payload.get("users") if isinstance(payload, dict) else None
-    if not isinstance(users, list) or not users:
-        raise PaymentCheckoutError(404, f"supabase user not found for email={email}")
-    user = users[0] if isinstance(users[0], dict) else {}
-    user_id = str(user.get("id") or "").strip()
-    if not user_id:
-        raise PaymentCheckoutError(404, f"supabase user id missing for email={email}")
-    return user_id
+    return _select_exact_user_id(payload, email)
 
 
 def main() -> int: