Read one tenant-authorized local last-good provider quote

PostgreSQL-only read. The request never calls or schedules a provider. Entitlement and Market Policy gates run before any quote payload is returned.