feat(integration): prepaid billing, engine UI, credits console, direct tasks, v2 final

- Prepaid credit system: org wallet, debit on usage, chat gate, admin credit console
- Engine UI: /manager, /tasks, /tasks/[id], /workforce, /dashboard, /traces pages
- Direct task creation (HTTP POST /tasks, MCP tasks_create) at pending_manager_review
- Pause/resume/cancel/answer actions in engine API and UI
- Employee cap (7 per org default), review pipeline guard (active reviewer required)
- Scheduler: wide window prevents org starvation; archived employees excluded from cap
- Tenant isolation: project-id cross-org 404, engine never uses another tenant's sandbox
- Order route fix: manager built with pipeline states + employee profiles
- Contract extension: ModelGrantPort.get_org_policy with DefaultOrgPolicy
- Engine event types in @agy/contracts (task.step, task.gate, run.log, run.tool, team.changed)
- api-engine.ts typed client; api-credit.ts client
- Alembic migration c4d5e6f7a8b9: prepaid credit + engine UI tables
- 859 tests passed, 1 skipped; ruff/mypy/tsc/eslint/vitest all green

Refs: PLAN-v2.md §9 (T1–T43), todo-v2-final.md

packages/contracts/src/index.ts

@@ -838,7 +838,56 @@ export type WsEventType =
   | "release.live"
   | "deploy.status"
   // v2 org platform: org memory changed (taught, edited, or reflected on).
-  | "memory.changed";
+  | "memory.changed"
+  // v2 AI workforce engine: stage moves, gate verdicts, live run logs and tool
+  // results, and team changes.
+  | "task.step"
+  | "task.gate"
+  | "run.log"
+  | "run.tool"
+  | "team.changed";
+
+/* -- AI workforce engine payloads (channels `task:<id>`, `run:<id>`, `org:<id>`) -- */
+
+/** A task moved to another stage of its pipeline (`task.step`). */
+export interface TaskStepEventData {
+  task_id: string;
+  from: string;
+  to: string;
+  pipeline: string;
+  status: TaskStatus;
+}
+
+/** One gate verdict on a task (`task.gate`). */
+export interface TaskGateEventData {
+  task_id: string;
+  gate: string;
+  ok: boolean;
+  detail: string;
+}
+
+/** A batch of live log lines from one run (`run.log`). */
+export interface RunLogEventData {
+  run_id: string;
+  task_id: string;
+  lines: string[];
+}
+
+/** One tool call that finished in a run (`run.tool`). */
+export interface RunToolEventData {
+  run_id: string;
+  task_id: string;
+  tool: string;
+  ok: boolean;
+  summary: string;
+}
+
+/** The team changed: a hire, a fire or a tier change (`team.changed`). */
+export interface TeamChangedEventData {
+  change: string;
+  employee_id: string;
+  organization_id: string;
+}
 
 /** One pushed event, as the browser receives it. */
 export interface WsEvent<T = Record<string, unknown>> {