Returns the SAME report GET /usage-limits serves, rendered as an RFC 4180 CSV
attachment for an audit package, a spreadsheet or a third party.

One computation, two representations. The figures are produced once, by the same
service call the JSON endpoint makes, and then written. Nothing is recomputed for the
export, so the file and the screen cannot disagree about a number.

What the file states about itself. It opens with a #-led preamble carrying, in the
artifact rather than in a covering email: the report name; the scope the caller read
under; the population the figures are taken over (keys subject to a hard
maxUsageLimit, meaning one greater than zero — a key with no cap is outside the
report, because a percentage of an absent limit does not exist, and under the platform
sentinel an unlimited key is stored as 0 rather than as an absent value); the
completeness of the rows (COMPLETE — every key in the
population is present, so the artifact does not depend on how far a screen was
scrolled); and then EVERY member the JSON response publishes, keyed by that member's own
JSON name, including usageHighAbovePercent, usageCriticalAbovePercent and
generatedAt. The instant is the report's own, never a second clock reading taken at
write time.

The data records follow, one per key, under a header row that IS
UsageLimitKeyInfo's member list in declaration order. The file terminates with
# EXPORT COMPLETE; its ABSENCE is the third state, and means the stream broke before
the end — an HTTP 200 already on the wire cannot be retracted, so a short well-formed
CSV with no marker must not be read as the whole report.

A kid, alg or status opening with a character a spreadsheet reads as a formula is
prefixed with an apostrophe at the writer.

Why produces names application/json as well as text/csv: the success
representation is CSV, but every refusal this operation can answer is an RFC 9457
application/problem+json body. A mapping that narrowed produces to text/csv alone
would be unselectable by a client sending Accept: application/json, which collapses
those error bodies along with the success status.

Authorization: the report's own scope — admin.tenant.analytics.read. Exporting a
report is reading it, so it grants nothing the screen does not.