Return the signed-in user's live subscription summary, or nulls.

The summary is the user's live (granting) subscription: {portal_available, status, tier, renews_at, ends_at, granting_count}, drawn from the newest granting row. With no live subscription every field is null or false and the count is 0 — the console then hides the "Invoices and payment method" button. Used by the account page to render current plan status + renews/ends and that button. Bearer-authed like the /exports routes — the web server forwards the session token in the Authorization: Bearer header and current_token verifies it.

The route reports a BOOLEAN, never a URL. Paddle's portal link is single-use and short-lived, so a render-time mint would burn one session per account page and hand a second reader a spent link. The console renders a button from this flag and mints at the click through POST /me/billing/portal. The flag restates that route's own precondition, so a true here means the POST can mint, and it fails closed: an unconfigured box reports false.

The flag carries no scope gate. The capability is the mint, and the POST demands billing:write for it (TEN-03).

granting_count is how many subscriptions of the caller grant a tier at that one clock. The console plan page reads it to pick one of its three states, because POST /me/billing/plan refuses a count other than one. The count needs no second query: the loop below already reads every row.