Assign one seat of an entitlement to a resource

Consumes ONE seat of the entitlement's pool for the given resource, so the licence is recorded as being in use there. An entitlement with quantity: N supports N simultaneous assignments to N DISTINCT resources. Deleting the resource RELEASES the seat and leaves the entitlement active and still billing — the entitlement outlives the resource, which is the whole point of an account-level entitlement. Validation: resourceType must be one of instance|volume|load_balancer; resourceId must be a LIVE resource of the caller's own tenant (another tenant's or a deleted resource is 404 NOT_FOUND, never 403 — the check is row-level security, so a foreign id is indistinguishable from a missing one). 409 CONFLICT when the pool is exhausted, with a message naming the entitlement and its seat count; 409 CONFLICT when this resource already holds a seat of this entitlement; 409 CONFLICT when the entitlement's term has ended. A CANCELLED but in-term entitlement is still assignable. Caller needs billing:write, else 403. Async & state: Synchronous. The seat cap is enforced under a row lock, so the (N+1)th concurrent assignment is refused synchronously rather than queued or silently trimmed. Errors: 401; 403; 404 unknown scope, entitlement or resource; 409 pool exhausted / already assigned / term ended; 422 malformed body; 500. Idempotency/Concurrency: Re-assigning the same resource is a 409, not a silent success.