Metered and entitled delivery, so a publisher can charge for content

Every news organisation that makes money makes it here, and delivery has no concept of it. Content is `Public` or it is not. There is no "the first three articles this month are free", no "subscribers only", and no way to give a paying reader access to something an anonymous one cannot have.

`SensitivityLevel` is the closest thing and it is the wrong shape: it decides what to mask, not who is entitled.

## What a module would add

- An entitlement on a caller: what this reader has paid for, and until when.
- A rule on a content type or an entry: free, metered, or entitled only.
- A counter for the metered case, per reader, per window.
- A delivery response that says which of the three it took, so a front end can show a wall instead of an empty page.

## The parts that decide whether this works

**The meter counts on the cache, not on the origin.** If delivery is cached at the edge (see the surrogate keys issue), the origin never sees the request that should have decremented the counter. Either the metered path is uncacheable, or the meter lives at the edge. This is the design decision; everything else is bookkeeping.

**A partial response is a real response.** Returning the first two paragraphs to a non-subscriber is the standard behaviour and it means the masking projection needs a notion of truncation, not just of hiding a field.

**Refusing has to be honest.** A reader over the meter gets a documented status and a body that says why, not a 404 that looks like the article does not exist.

## Scope note

This is a module, and a large one. Filing it as the marker for the news-publisher story rather than as something to start soon. It depends on the caching design being settled first, because the meter and the cache cannot be designed separately.

Start by reading the existing SensitivityLevel implementation and the surrogate keys issue referenced in the proposal. Before implementation, settle whether metering is cacheable and define the entitlement, metering, partial-response, and refusal semantics; done means those design decisions are documented and a module scope is agreed.

Written by the indexing model from the issue text.