Create a central subaccount product

Requires a platform key with scope * or catalog:write and Cooud-Account: cooud_subacct_… of a platform_central subaccount; Cooud-Account, Idempotency-Key and Cooud-Compat-Date are mandatory. Standard Connect accounts (cooud_acct_…) and store keys receive 403 catalog_write_not_supported. Sandbox stores the object in the subaccount's persistent test catalog, isolated by platform and subaccount; live uses the native catalog. Does not charge customers or change existing subscriptions. Live creates and publishes the product (live: true). Server-set fields: slug api-<lowercase ULID>, domain entrepreneurship, product_type digital, thumbnail_url null. Check order: request JSON (400 before authentication); Authorization, Cooud-Compat-Date, Cooud-Account and rate limit; body and Idempotency-Key (400 parameter_invalid); write permission (403); idempotency (201 replay or 409); creation (404, 503). A store key or Connect account without Idempotency-Key therefore gets 400, not 403. Idempotency: the key is scoped by platform, environment, subaccount and operation, not by credential, and is reserved before any effect. The same key with the same validated body replays the original 201, including the original request_id (the Request-Id header identifies the new request); there is no Idempotency-Replayed header and successful receipts do not expire. The comparison ignores property order and leading or trailing spaces in name; an explicit null or {} differs from an omitted field. A failure without effect releases the key, so the same key runs the creation again. An uncertain result answers 409 catalog_operation_pending for 15 minutes from the start of that attempt; afterwards the same key and body send the creation again, without reusing what the uncertain attempt may have left.