Preflight endpoint — returns whether the caller is an admin, whether the tenant is write-entitled (Professional/Enterprise/trial/partner-master) and Enterprise-entitled, plus plan and quota. Open to any authenticated user, so a client can check what it is allowed to do before attempting gated calls.