Pause the billing subscription (halt new provisioning)

Pauses the account-level billing subscription ("Pause" in the detail header, behind a destructive confirm dialog). While paused, already-running resources keep billing but no new resources can be provisioned in the subscription; the subscription's state becomes visible to all subsequent reads and gates provisioning checks across the console. Validation: billingSubscriptionId must identify a subscription visible to the caller in scopeId (else 404 NOT_FOUND); the current state must permit pause — only ACTIVE subscriptions can be paused, while FREEZE, SUSPENDED and PENDING_MANUAL_APPROVAL map to 409 CONFLICT (illegal state transition); the caller must hold owner|admin (a destructive, subscription-wide command; else 403); a malformed Idempotency-Key maps to 422 VALIDATION_FAILED. Async & state: Asynchronous; returns 202 with an Operation. The subscription transitions ACTIVE → FREEZE once the pause propagates to provisioning gates; the Operation progresses PENDING → RUNNING → SUCCEEDED | FAILED, emitting resource.updated SSE frames with kind 'operation' ({ state } patches) and kind 'billingSubscription' with a { state: "FREEZE" } patch on completion. A PAYMENT/STATE entry is appended to the subscription activity log. Errors: 401 unauthenticated; 403 role may not pause this subscription; 404 unknown/invisible billingSubscriptionId; 409 state is not ACTIVE (already paused, suspended, or pending manual approval); 422 malformed Idempotency-Key; 500 internal. Idempotency/Concurrency: Idempotency-Key is optional (recommended); replaying the same key within 24h returns the original 202 body without issuing a second pause. This operation does not check If-Match; a sent one is ignored (pausing a subscription that is no longer ACTIVE is the 409 above).