Returns every recorded attribution interval for the session, current interval first (effectiveFrom descending), so element 0 is what the session is attributed to now.

Response shape depends on the caller's plane (PRODUCT-2671). A management-plane caller (WRITE-scoped API key or JWT) receives every field, including the provenance of the write that created the interval (apiKeyId, createdBy — the hashid of the API key used, null for browser-session writes and intervals recorded before provenance was captured, and the email of that credential's owner) and of the write that most recently modified it (modifiedBy, updated). A METERING-scoped API key receives only ticketId, ticketTitle and effectiveFrom — the fields it needs to read back what a session is currently attributed to; apiKeyId, createdBy, modifiedBy and subscriberEmail are omitted from the response entirely for that caller, never nulled.

Dual-auth, mirroring the POST: callable by the management plane, or by a METERING-scoped API key restricted to its own organization (see [io.hypercurrent.profitstream.service.v2.security.AuthenticationExpressionService.canReadSessionAttribution]).