Add SETTINGS_URL/SECRET to compose, fix sync email-change and rate-limit bugs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/workforce.js

@@ -71,6 +71,17 @@ export async function findEmployeeByEmail(email) {
   return users.length > 0 ? users[0] : null
 }
 
+// Try direct ID lookup first (standard REST); returns null if endpoint not supported
+export async function findEmployeeById(wfUserId) {
+  try {
+    const data = await wfFetch(`/api/v2/users/${wfUserId}`)
+    // Some APIs wrap in { user: ... }, others return the object directly
+    return data?.id ? data : (data?.user ?? null)
+  } catch {
+    return null
+  }
+}
+
 export async function getAllDepartments() {
   return wfFetchPaged('/api/v2/departments')
 }