Pre-scan check. Answers, for one customer, whether their next scan needs paying
for — so a surface can either go straight to scanning or show the correct price
up front, instead of collecting photos and then discovering a 402.

Needed because the answer is not always derivable from vendor config:

• scan_payment_bearer = vendor → never payable (requires_payment: false).
• scan_payment_bearer = customer → always payable.
• scan_payment_bearer = vendor_then_customer → the vendor covers this
  customer's first covered_scans_quota scans and the customer pays beyond
  that, so the answer depends on how much of THEIR allowance is left.

A "covered" scan is not free — it is a normal billable scan on the vendor's
invoice. It is only free to the customer.

Coverage ends on either of two limits: the customer's own allowance running
out, or the vendor reaching their monthly scan spend cap. Both make
requires_payment true; vendor_coverage_suspended says which, so the
price can be explained rather than appearing to contradict a remaining
allowance. A spend cap never refuses a scan the customer is paying for.

Read-only: resolves the customer but never creates one, so it is safe to call
on a partially-typed or mistyped email.

The allowance is scoped per (vendor, customer email): the same person gets a
separate allowance from each vendor they scan with.