Return everything the auth gate decided about this request.

<br/>Use cases:<br/><br/>- Confirm session-based auth is wired correctly (session_present).<br/>- Confirm a Bearer JWT was accepted (bearer_token_present).<br/>- Inspect the Cognito groups your token carries (groups).<br/>- List every Cognito identity (Google / Facebook / email) linked<br/> to your local user row (identities).<br/>- Sanity-check the pool the backend is pointed at (cognito_*).<br/>- See whether the request runs under an admin impersonation grant<br/> (impersonating + real_admin_email, spec §3.6); the SPA<br/> banner renders from this, the server's truth.<br/>- Read whether the caller has a product subscription at all<br/> (has_subscription), which is what tells the partner shell<br/> whether a Product tab would lead anywhere but the paywall.<br/>- Read whether the caller is in the affiliate program at all<br/> (is_affiliate), which is what lets the plan paywall offer a<br/> partner a route back to their portal.<br/><br/>Authenticated callers only — anonymous requests get 401.