Fetch one recipient by id.

A recipient that belongs to a different merchant returns 404, so its existence isn't revealed.

Merchant users work on their own merchant's recipients. Tenant owners and admins can work on any merchant in their tenant by passing ?merchantId=. A merchant in another tenant returns 404. Other roles are refused.

Authenticate with a dashboard session token, or a merchant-pinned secret key in X-API-Key. A secret key acts only for its own merchant: anything it creates belongs to that merchant and records the key as the actor, and another merchant's recipients return 404. Publishable, payout_write and agent_onboarding keys are refused.