Move one seat of an entitlement between two resources, atomically

Moves ONE seat from fromResourceId to toResourceId in a single transaction. There is never a window in which the seat is on both resources or on neither. A DEDICATED operation rather than "release then assign": two calls cannot transfer a seat on a FULL pool at all — assigning first finds no free seat, and releasing first opens a window another caller can steal the seat in. The transfer therefore succeeds even when every seat is taken, which is the common case for a seat-based licence. Validation: resourceType must be one of instance|volume|load_balancer; fromResourceId must currently hold a seat of this entitlement (else 404 NOT_FOUND); toResourceId must be a LIVE resource of the caller's own tenant (else 404) that does not already hold a seat of this entitlement (else 409 CONFLICT); source and destination must differ (else 422 on field toResourceId); the entitlement's term must not have ended (else 409). Caller needs billing:write, else 403. Async & state: Synchronous and atomic under a row lock on the entitlement. Errors: 401; 403; 404 unknown scope, entitlement, source assignment or destination resource; 409 destination already assigned / term ended; 422 malformed body or same source and destination; 500. Idempotency/Concurrency: Replaying a completed transfer is a 404 (the source no longer holds the seat), not a double move.