feat(integration): prepaid billing, engine UI, credits console, direct tasks, v2 final

- Prepaid credit system: org wallet, debit on usage, chat gate, admin credit console
- Engine UI: /manager, /tasks, /tasks/[id], /workforce, /dashboard, /traces pages
- Direct task creation (HTTP POST /tasks, MCP tasks_create) at pending_manager_review
- Pause/resume/cancel/answer actions in engine API and UI
- Employee cap (7 per org default), review pipeline guard (active reviewer required)
- Scheduler: wide window prevents org starvation; archived employees excluded from cap
- Tenant isolation: project-id cross-org 404, engine never uses another tenant's sandbox
- Order route fix: manager built with pipeline states + employee profiles
- Contract extension: ModelGrantPort.get_org_policy with DefaultOrgPolicy
- Engine event types in @agy/contracts (task.step, task.gate, run.log, run.tool, team.changed)
- api-engine.ts typed client; api-credit.ts client
- Alembic migration c4d5e6f7a8b9: prepaid credit + engine UI tables
- 859 tests passed, 1 skipped; ruff/mypy/tsc/eslint/vitest all green

Refs: PLAN-v2.md §9 (T1–T43), todo-v2-final.md

apps/api/tests/test_mcp.py

@@ -36,6 +36,7 @@ from app.core.config import settings
 from app.core.errors import ValidationError
 from app.domain.base import new_id, utcnow
 from app.domain.identity.models import PlatformRole, Role
+from app.domain.workforce.pipeline import Stage
 from app.infrastructure.db.models import (
     AuditEventRow,
     MembershipRow,
@@ -49,6 +50,7 @@ from app.infrastructure.db.models_delivery import (
     ProductionDeployRow,
 )
 from app.infrastructure.db.models_org import McpTokenRow
+from app.infrastructure.repositories.engine import PipelineStateRepository
 from app.interfaces.mcp.gateway import McpGateway
 from tests.conftest import auth_header, signup
 
@@ -348,6 +350,7 @@ async def test_pipeline_status_reports_the_delivery_state_and_no_host_details(
 async def test_a_task_created_through_a_token_is_attributed_to_its_minter(
     session_factory, seeded
 ):
+    """The task is attributed to the minter and enters the engine at manager review (D-D)."""
     org_id, user_id = await _org(session_factory, "task-org")
     gateway = await _gateway(session_factory)
     token = await _token(
@@ -374,6 +377,12 @@ async def test_a_task_created_through_a_token_is_attributed_to_its_minter(
         assert row is not None
         assert row.created_by_user_id == user_id
 
+    # Decision D-D: a task created through the gateway enters the engine at manager review.
+    async with session_factory() as session:
+        state = await PipelineStateRepository(session).get(task_id)
+    assert state is not None
+    assert state.stage is Stage.PENDING_MANAGER_REVIEW
+
     # …and a task from another organization is a 404, not data.
     other_org, _ = await _org(session_factory, "task-other")
     other_token = await _token(