Open a new subscription (with its default project) under the tenant

Creates a subscription (billing account) beneath the tenant and, in the SAME transaction, its default project core (: a subscription is never created without a project). The subscription itself is a pure catalog row and is returned at once (201); the default project provisions its Keystone project asynchronously, tracked by provisioningOperationId (always present -- poll GET /operations/{operationId}). The subscription id is derived from the tenant id + the slugified name (numeric suffix on collision) and never changes. Authorization: the caller must be an OWNER OF THE TENANT (a tenant-kind owner grant, -- owning one subscription or project is not enough): reached-but-not-owner is 403, an unknown/unreached tenant 404. An API token needs BOTH the iam:write and the billing:write action scopes, as a subscription is a billing account -- missing either is 403 TOKEN_SCOPE_MISSING before the tenant is resolved and nothing is created (iam:write is checked first). A service-account key is refused 403 INTERACTIVE_SESSION_REQUIRED whatever its scopes (an SA key never performs an iam:write action). A console session is gated by the owner role alone. A tenant on non-payment hold is refused 403 TENANT_SUSPENDED. Validation: name must be ASCII and contain a letter or digit (422, field=name); currency is optional and USD-only (any other value 422 field=currency, details.supportedCurrencies); billingCountry is REQUIRED and must be an allowed country (GET /tenants/{tenantId}/billing-countries; otherwise 422 field=billingCountry, details.allowedBillingCountries); an unknown body field is 422. The tenant's subscription cap (max_subscriptions_per_tenant) and the per-subscription project cap are enforced in the same transaction -- 409 QUOTA_EXCEEDED, nothing is created. Async & state: subscription synchronous; default project PENDING → provisioned by the iam.scope.provision Operation. Errors: 401; 403 not a tenant owner / token scope (iam:write, billing:write) / service-account key / tenant on hold; 404 tenant not reached; 409 QUOTA_EXCEEDED or an Idempotency-Key reused with a different body (CONFLICT); 422 validation (including a non-UUID Idempotency-Key); 500. Idempotency/Concurrency: Idempotency-Key (UUID) is optional (recommended); a replay returns the original 201 without minting a second subscription; concurrent same-key requests collapse to one.