Read the bounded, customer-scoped Capabilities aggregate

Returns one read-only Capabilities page DTO: the workspace's capabilities record (status, approved profiles, channels, all_countries/countries, calling rules and whether they are active), the caps that bind right now as limits (the workspace's velocity and spend risk controls above zero, not the profile caps projected at activation; a cap of zero is disabled and not listed), live usage against the caps, the use-case profile catalog a request offers, campaigns (whether campaigns are part of what this workspace may do: included for an active record with voice, voice_required, or not_active; and every_launch_reviewed for the custom implementation-services profile -- there is no per-profile campaign switch), the countries the workspace already has numbers in (bounded, with has_more), and its open capability reviews (bounded, with has_more). Tenant-bound to the bearer session; no provider request and no write.