Move a project to another subscription of the same tenant

Moves the project to targetSubscriptionId. SYNCHRONOUS: nothing in OpenStack changes (the project keeps its id, Keystone project, app-cred, scope projection and every resource); the catalog + billing rewrite is one transaction that either happens completely or not at all. Billing is sealed under the SOURCE at cutoverAt; every usage hour starting before billingBoundary belongs to the source, every hour starting at or after it to the destination. An iam.project.move Operation is recorded already SUCCEEDED for the audit trail (operationId); there is nothing to poll. Authorization: a SUBSCRIPTION-level owner grant on BOTH the source and the destination subscription: unreached project or destination 404, not owner on either end 403. An API token is refused 403 TOKEN_SCOPE_MISSING (iam:write is never grantable); tenant on non-payment hold 403 TENANT_SUSPENDED. Validation / preconditions (checked before anything is written): destination equal to the current subscription 422; different currency 409 CONFLICT; the project's region is not the destination's defaultRegion 409 CONFLICT; destination at its project cap 409 QUOTA_EXCEEDED; the source would be left with no project 409 CONFLICT; unknown body field 422. Errors: 401; 403; 404; 409; 422; 500. Idempotency/Concurrency: Idempotency-Key (UUID) is optional (recommended); a replay returns the FIRST move's cut-over instant instead of re-sealing billing. A refused move leaves no idempotency record.