Who the caller is, and what is left of their free preview

The identity behind this request, resolved the same way every other route resolves it: a presented API key, then a session cookie, then an anonymous preview. signedIn reports whether a session was found; preview carries the remaining allowance and is null for a keyed or signed-in caller. Reads no corpus table and asserts nothing about the law. Sign-in itself is a browser redirect flow (/auth/google/start), not an API call, so it is not specified here. Answerable anonymously, but NOT a public discovery route: it reports on the caller's own credential, so it inherits the global security.