feat(subscription): add membership access preflight

app/ai.py

@@ -1753,6 +1753,37 @@ def _cmhub_call_with_retry(
     raise last_exc
 
 
+def request_cmhub_json(
+    method,
+    base_url,
+    endpoint,
+    api_key,
+    *,
+    payload=None,
+    connect_timeout=10,
+    read_timeout=30,
+    use_system_proxy=False,
+    headers_extra=None,
+):
+    """Call one cmhub JSON endpoint through the shared gateway session.
+
+    This is intentionally small: product-specific modules can reuse the same
+    proxy handling, connection pool, redaction and structured HTTP errors as
+    generation without reaching into private transport helpers.
+    """
+
+    _apply_cmhub_proxy(use_system_proxy)
+    return _cmhub_call_once(
+        method,
+        appconfig.cmhub_request_url(base_url, endpoint),
+        api_key,
+        payload,
+        connect_timeout=connect_timeout,
+        read_timeout=read_timeout,
+        headers_extra=headers_extra,
+    )
+
+
 def _cmhub_call_once(method, url, api_key, payload, connect_timeout, read_timeout, headers_extra=None):
     headers = {
         "Authorization": "Bearer " + str(api_key),