fix: restore /auth/login email mode + CheckUserLoginMethod empty-body fallback (v2.0.39)

Two regressions that surfaced together when smoke-testing /auth/login on
VPS with three real email accounts:

1. addAccountByEmail in src/auth.js had been stubbed to throw
   "Direct email/password login is not supported". Dashboard had a
   working windsurfLogin pipeline next door but HTTP /auth/login
   never reached it. Wired addAccountByEmail through windsurfLogin
   -> addAccountByKey -> setAccountTokens, mirroring dashboard's
   processWindsurfLogin.

2. CheckUserLoginMethod (Connect-RPC, primary email probe since
   2026-04-26) sometimes returns "{}" on Vercel cold-start edges.
   Old code mapped missing hasPassword to false and threw
   ERR_NO_PASSWORD_SET for every valid account. Fixed: when neither
   userExists nor hasPassword fields are present, return null so
   caller falls back to /_devin-auth/connections (which still
   returns the rich auth_method shape correctly).

VPS verified: three accounts (Joshua/Susan/Barbara) all login active,
chat completion against sonnet-4.6 returns "pong".

5 new regression tests; 423/423 pass (was 418/418).