Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/backend/core/admin.py`:
- Around line 242-271: The add_passwordless_view currently allows access without
enforcing model-level add rights; at the top of add_passwordless_view check
self.has_add_permission(request) and if it returns False deny access (e.g.,
raise django.core.exceptions.PermissionDenied or return HttpResponseForbidden)
before processing POST or rendering the form so only users with add permission
on the User model can create passwordless users; this uses the existing
add_passwordless_view method and self.has_add_permission to gate the endpoint.

In `@src/backend/core/api/serializers.py`:
- Around line 1098-1104: The current lookup uses
models.User.objects.filter(email=data).first() which silently picks one record
when multiple users share the same email; change the logic to explicitly detect
ambiguous matches: query = models.User.objects.filter(email=data), if
query.count() > 1 raise a validation/error (e.g., serializers.ValidationError or
appropriate API error) requiring a UUID instead of an email, if query.count() ==
1 return that user, and only create a new user (user = models.User(email=data);
set_unusable_password(); user.save()) when query.count() == 0; ensure the error
path prevents granting access when email is ambiguous.

In `@src/backend/core/models.py`:
- Around line 123-126: The call to self.get(email=email, sub__isnull=True) can
raise self.model.MultipleObjectsReturned for duplicate stub-email rows; modify
the try/except to also catch self.model.MultipleObjectsReturned and handle it by
selecting a single canonical row (e.g., use self.filter(email=email,
sub__isnull=True).order_by('pk').first()) or otherwise resolve/log and return
that single instance (or None) instead of letting the exception bubble; update
the exception handler around the self.get(...) call to perform this safe
fallback.