Return grace period state from the API

Two booleans per organisation, on the response the usage page already fetches:

- **has the paid grace period been used?** False means this month is covered, true means overage is charged. The page has to say which
- **can this organisation be cut off?** Restriction is switched on per organisation and some are exempt

**Careful:** the grace record is also written on the free path today, so it can be true for organisations that never used anything. Untangle that first or the page will tell customers they are being charged when they are not.

**Done when** a paid organisation over its limit can be told whether it is covered or charged.