Get Provider Channel Restrictions For Plan

Per production provider signup-plan rules: which channels are denied for this plan. Used by Automated Onboarding Provisioning to disable API/MCP checkboxes.

Restriction rows are keyed by tier, so a per-contract wholesale template (PRO-2309) resolves to the wholesale_client rules it inherits.