Per-account desktop (dripos) feature-flag entitlements

Returns the per-account feature-flag entitlements for the authenticated business. The desktop (dripos) client treats every flag as a grant that fails closed: any flag not returned with enabled: true is denied client-side. Entitlements are resolved server-side from a per-account allowlist keyed on the business's unique email. Requires a secret key (sk_*); public keys (pk_*) receive 403 Forbidden.