Buy a subscription-scoped add-on / licence entitlement

Buys one subscription-scoped catalog add-on or licence as an account-level entitlement. The chosen period's catalog price is FROZEN at purchase (a later catalog price change never re-prices this entitlement) and one immutable rate-card version is written for the entitlement's own SKU, so the existing rater prices its metered usage unchanged. quantity is the SEAT POOL size: an entitlement with quantity: N can be assigned to N DISTINCT resources at the same time, and seats can be released and transferred between them. No operator approval is required and nothing is charged at purchase. An entitlement is post-paid through the usage ledger exactly like an instance-scoped add-on: the charge reaches the customer on the next invoice, where the existing operator settlement gate applies. Validation: itemKind must be addon or license; itemId must reference an ACTIVE catalog item whose attachScope is subscription — an instance-scoped item is refused 422 VALIDATION_FAILED on field attachScope (the mirror of the refusal instance-create raises for a subscription-scoped item); period must be one of hour|month|year AND priced by the operator for that item (else 422 on field period); quantity must be an integer between 1 and 1000. Unknown or inactive item → 404 NOT_FOUND. Caller needs billing:write (owner|admin|billing-ops), else 403. Async & state: Synchronous — returns 201 with the created entitlement. No Operation is minted: there is no provider call to track. Errors: 401 unauthenticated; 403 insufficient role; 404 unknown scope or catalog item; 422 field validation failure including the attach-scope mismatch; 500 internal failure. Idempotency/Concurrency: Not idempotent — each call buys another entitlement. Clients that must retry safely should read the list first.