Easier method to find application entitlements that a user has

At the moment this requires going to each application or several API calls. Would be better if this could be checked directly on a user's account via the user directory and/or an API call that references the user.

The issue names no files, tests, or entry points. Start by locating the user directory and existing application-entitlement API paths, then determine the intended account-level lookup and its response shape; done should mean a user's entitlements can be retrieved directly without querying each application separately.

Written by the indexing model from the issue text.