Apply a Microsoft platform subscription's state to its organization (internal producers)

Internal; default off (503 platform_workspaces_disabled until `DECIONIS_PLATFORM_WORKSPACES_ENABLED` is 1). Only a producer whose token (`DECIONIS_DELIVERY_PRODUCERS_JSON`) carries `platforms: ["microsoft"]` may call it: no token or an unknown one is 401 producer_required, any other producer 403 platform_not_allowed, and an organization key is never accepted. Commerce passes the workspace mapping Accounts signed for a `decionis-platform` purchase, with its evidence, verbatim. Core checks the version, platform, product and environment (400 otherwise); that the Accounts organization and workspace ids derive from source_org_id, that issued_at is within the last 10 minutes, and the Ed25519 signature over the canonical (sorted-key) mapping against the current Accounts JWKS (422 accounts_evidence_invalid with reason ids, stale or signature; 503 accounts_evidence_unavailable while the JWKS is unreachable). In one transaction it creates the organization with id = source_org_id, no Core owner, source product decionis and the production environment, its default entitlement, and the synchronized Accounts workspace reference, so the buyer's later Decionis sign-in to that workspace lands in this organization. The same reference again is 200 replayed; an existing organization with any other reference, a workspace already bound elsewhere, or an organization created for another subscription is 409 organization_conflict. No person, session or key is created. The optional `subscription` is the subscription's current state from Commerce's lifecycle, outside the signature: its paid plan becomes the organization's entitlement in the same transaction (422 plan_unknown for a plan code Core does not sell, before any write), and the answer reports what it did as `subscription`. Without it the organization gets the default entitlement.