List the recipients that belong to a merchant.

Merchant users work on their own merchant's recipients. Tenant owners and admins can work on any merchant in their tenant by passing ?merchantId=. A merchant in another tenant returns 404. Other roles are refused.

Authenticate with a dashboard session token, or a merchant-pinned secret key in X-API-Key. A secret key acts only for its own merchant: anything it creates belongs to that merchant and records the key as the actor, and another merchant's recipients return 404. Publishable, payout_write and agent_onboarding keys are refused.