Skills and rules the caller receives from their org (QUA-3060).

The desktop backend polls this with the member's Quadrillion key; the hosted backend reads the same rows in-process. A user with no org gets empty lists, not an error, so a desktop never retries on it. The ETag is a hash of the body, so an unchanged org answers a cheap 304.

While the org has the feature off, every member gets empty lists and can_manage false, however they connect. Otherwise can_manage tells either app whether to offer editing; the write routes enforce it independently.