feat(integration): prepaid billing, engine UI, credits console, direct tasks, v2 final

- Prepaid credit system: org wallet, debit on usage, chat gate, admin credit console
- Engine UI: /manager, /tasks, /tasks/[id], /workforce, /dashboard, /traces pages
- Direct task creation (HTTP POST /tasks, MCP tasks_create) at pending_manager_review
- Pause/resume/cancel/answer actions in engine API and UI
- Employee cap (7 per org default), review pipeline guard (active reviewer required)
- Scheduler: wide window prevents org starvation; archived employees excluded from cap
- Tenant isolation: project-id cross-org 404, engine never uses another tenant's sandbox
- Order route fix: manager built with pipeline states + employee profiles
- Contract extension: ModelGrantPort.get_org_policy with DefaultOrgPolicy
- Engine event types in @agy/contracts (task.step, task.gate, run.log, run.tool, team.changed)
- api-engine.ts typed client; api-credit.ts client
- Alembic migration c4d5e6f7a8b9: prepaid credit + engine UI tables
- 859 tests passed, 1 skipped; ruff/mypy/tsc/eslint/vitest all green

Refs: PLAN-v2.md §9 (T1–T43), todo-v2-final.md

apps/api/tests/test_model_grants.py

@@ -16,6 +16,7 @@ from httpx import AsyncClient
 from sqlalchemy import select
 
 from app.application.container_org import build_model_grant_service, build_model_grants
+from app.application.engine.manager import BOOTSTRAP_TIERS
 from app.core.config import settings
 from app.infrastructure.db.models import AiModelRow, AuditEventRow, OrgModelGrantRow
 from app.infrastructure.db.models_org import DefaultModelGrantRow, OrgPolicyRow
@@ -323,13 +324,18 @@ async def test_policy_defaults_caps_and_audit(
     session_factory,
     seeded,
 ):
+    """D-A: the default cap is 7 employees per organization (it was 5).
+
+    The starting team (``BOOTSTRAP_TIERS``, 4 employees) must fit under that default.
+    """
     org_id = await _create_org(client, manager_token, "سازمان د", "delta-org")
     owner = auth_header(platform_owner_token)
 
     fresh = await client.get(f"{POLICIES}/{org_id}", headers=owner)
     assert fresh.status_code == 200, fresh.text
     body = fresh.json()
-    assert body["max_employees"] == 5
+    assert body["max_employees"] == 7
+    assert len(BOOTSTRAP_TIERS) <= body["max_employees"]
     assert body["automation_enabled"] is True
     assert body["mcp_enabled"] is True
     assert body["monthly_credit_budget"] is None
@@ -383,6 +389,7 @@ async def test_policy_defaults_caps_and_audit(
 async def test_policy_is_isolated_per_organization(
     client: AsyncClient, manager_token: str, platform_owner_token: str, seeded
 ):
+    """D-A: a cap written for one organization leaves the other at the default of 7."""
     org_a = await _create_org(client, manager_token, "سازمان ه", "epsilon-org")
     org_b = await _create_org(client, manager_token, "سازمان و", "zeta-org")
     owner = auth_header(platform_owner_token)
@@ -392,4 +399,4 @@ async def test_policy_is_isolated_per_organization(
     a = await client.get(f"{POLICIES}/{org_a}", headers=owner)
     b = await client.get(f"{POLICIES}/{org_b}", headers=owner)
     assert a.json()["max_employees"] == 2
-    assert b.json()["max_employees"] == 5
+    assert b.json()["max_employees"] == 7