Check whether the caller may see the in-product Aletheia assistant (DARK MVP).

The single check the front-of-house widget polls BEFORE rendering (MNE-1930/1931) — the backend is the ONLY authority; the client never inspects the flag or allowlist itself. Reuses the exact supportAccessAllowed predicate POST /v1/aletheia-support/{chat,voice} enforce, so this can never drift out of sync with what those routes would actually allow. Unlike the chat/voice routes, ALWAYS returns 200 — the gate-check's own existence isn't sensitive (it reveals nothing about grounding/answers) — with allowed reflecting the real decision (false for flag-off, non-allowlisted, or no caller at all).