Returns the tenant's cryptographic-posture HISTORY over the requested [from, to] window
(inclusive; window must not exceed 365 days and to must be after from, else 400). The
response is an ordered per-day series (oldest first) of the four CAPA pillars' raw
{numerator, denominator} facts and per-pillar net flow, from the tenant's own append-only
snapshot chain. Scalars and facts only — no key identifier or policy field value.

Set projection=true to also receive a per-pillar linear projection to the 100% target. Each
projection is served with the framing that produced its confidence: points, the usable-point
count it was derived from, and exactly the boundaries that decided it — minPointsForTrend
(the lower edge of MEDIUM) and pointsForHigh (the lower edge of HIGH).

There are FIVE outcomes, not three. HIGH and MEDIUM carry both boundaries. LOW carries a
lowReason token from a closed three-member vocabulary — SHORT_SERIES, NO_X_AXIS_SPREAD,
FLAT_OR_DECLINING — with the i18n key that names it, so the reader is told WHICH kind of
"no forecast" this is. A two-point series is SHORT_SERIES, not a degeneracy. The two
genuinely degenerate reasons carry NO boundary: there the point count is at or above the trend
minimum and explains nothing, so no count is presented as the cause.

Authorization:
• Tenant admins: view own tenant's history only
• Platform admins: view any tenant's history (non-SaaS deployments)

Path Parameter Validation:
The tenantId in the URL must match the JWT tenantId claim
(unless authenticated as platform admin with PLATFORM.ROOT scope).