POST /users gets an email that already belongs to a Fundor account, nothing is created and you get:
1
Send the person to approvalUrl
Show a button such as “Connect your Fundor account”. The URL is safe to show: approving requires signing in to fundor.io as that account’s owner.
2
They approve or decline on fundor.io
The request expires after 7 days.
3
Call POST /users again
Once approved, the same call returns
200 with status: "linked" and the userId. Until then, every endpoint returns 403 for that user.