Resolves the tenant's effective RFC 3161 TSA usage policy from the database (tenant override → deployment default → code DEFAULT DISABLED, never deny-all) and re-projects it to Redis via the single existing projector. Returns 200 with the flat scalar policy for every existing tenant. A non-existent tenant returns a uniform, oracle-safe 404 that does not confirm existence. Requires the ankasecure-core S2S issuer and the admin.s2s.tsa-usage-policy.read scope.