Get the account's trace-content policy

A document of facets, one field per facet — capture today; retention and redaction configuration are the named next ones, each arriving as an additive field. capture: store admits the content half of an ingested trace into the content plane, drop discards it at the worker, and null means the account never chose — which resolves as drop, the fail-closed default. Readable by any member: clients strip content at emit when the effective capture is drop, so this is the login-time read that makes that possible.