feat(provider-tangle): resolve hosted subscription credentials

[drewstone]

A remote research controller can now resolve a subscription profile through an authenticated account owner without carrying native account homes or setup tokens.
The Provider forwards the exact profile, immutable dispatch key, and original validity deadline; the response contains only narrowly granted Sandbox secret references.

Capacity errors preserve explicit quota versus unavailable state and reset metadata without exposing private diagnostics or inventing HTTP status.
The account owner implementation is delivered separately in drewstone/tangle-tools.

Validation: 545 Provider source tests, types and workspace build passed.
Independent review passed 32 HTTP/command transport cases with no blocking finding.
Normal merge-tree and push hooks passed against current main.
The only follow-up change formats the release note.
Hosted deployment and actual quota pause remain live proof, not claims established by these tests.

[tangletools]

✅ Auto-approved PR — f4caca94

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-02T07:06:22Z}