Deny a hosted gateway sign-on request (signed-in owner)

From the page itself: the request must carry `Sec-Fetch-Site: same-origin` (`same-site` is refused: the session cookie reaches every subdomain) or, without it, an `Origin` that is the web application's own (the web proxy forwards the browser's headers), and a JSON body (415 JSON_CONTENT_TYPE_REQUIRED otherwise, so no form can send it). The session must come from a sign-in that proved its email (an email code, a password, Accounts, or an OAuth provider that asserted the address verified; otherwise 403 VERIFIED_EMAIL_REQUIRED, sign in again), that email must equal the request's owner email (case-insensitive), and the user must be ADMIN or above in `org_id`, a workspace on a paid plan (`org_entitlements.plan_code`; a Stripe subscription in `trialing` counts as its plan) whose entitlement Accounts holds active, all read at approval. On success the session is bound to `org_id` (a new account-session cookie is set when it was bound elsewhere), so the console's key list and billing show the workspace that now holds the gateway's key.