Looks up a customer without creating or updating. Resolution order matches find-or-upsert:

1. externalId (when provided and non-empty)
2. phone — supply phoneCountryCode, phoneAreaCode, and phoneNumber together
3. email (when provided)

At least one of these lookup paths must be present; otherwise the API returns 400.

The retailer is resolved only from the authorizer context (retailerId is not read from query parameters).