Answer the URL that opens the caller's billing management.

A POST, not a GET, for the reason POST /me/billing/checkout states: the route MINTS a single-use portal session, and a GET is prefetchable, so a link scanner would burn the session before the person clicks. The route demands billing:write, which the console session mint alone grants: the portal opens the invoices, the payment method and a cancel, so an agent credential answers 403 (TEN-03).

The route mints when the box holds a Paddle client AND the caller's granting row names a Paddle customer. It answers 503 when either is missing: an unconfigured box has nothing to mint against, and a row with an empty customer id came from a payload that carried none, which is an operator's problem rather than the user's retry (design/OPS-RUNBOOK.md).

A caller with no granting subscription answers 409: there is no subscription to manage, which is the checkout route's shape for a state the console must name rather than retry.

The route caches nothing. A Paddle portal session is single-use, so a cached link would hand the second clicker a spent URL.