Affiliate credit rollup

Balances for the calling key's organization and each of its affiliates. Requires the orgs:manage scope — balances are money data, and the underlying function requires that grant in SQL, so read:orgs alone would publish a contract the database refuses. Balances ONLY: a parent sees what its affiliates spend, never what they secured. Lifecycle: a child requests affiliation (dashboard) and becomes PENDING; approve moves PENDING to APPROVED; credits move only while the affiliate is APPROVED and not suspended; offboard reclaims the remaining credits and suspends the affiliate, in any status; revoke ends the relationship from APPROVED or PENDING. offboard then revoke and revoke then offboard are both supported - offboard never requires APPROVED and revoke never refuses a suspended affiliate. Counts against the API key monthly usage quota (no exemption exists for administration routes) and requires the organization payment state to be current.