feat(integration): prepaid billing, engine UI, credits console, direct tasks, v2 final

- Prepaid credit system: org wallet, debit on usage, chat gate, admin credit console
- Engine UI: /manager, /tasks, /tasks/[id], /workforce, /dashboard, /traces pages
- Direct task creation (HTTP POST /tasks, MCP tasks_create) at pending_manager_review
- Pause/resume/cancel/answer actions in engine API and UI
- Employee cap (7 per org default), review pipeline guard (active reviewer required)
- Scheduler: wide window prevents org starvation; archived employees excluded from cap
- Tenant isolation: project-id cross-org 404, engine never uses another tenant's sandbox
- Order route fix: manager built with pipeline states + employee profiles
- Contract extension: ModelGrantPort.get_org_policy with DefaultOrgPolicy
- Engine event types in @agy/contracts (task.step, task.gate, run.log, run.tool, team.changed)
- api-engine.ts typed client; api-credit.ts client
- Alembic migration c4d5e6f7a8b9: prepaid credit + engine UI tables
- 859 tests passed, 1 skipped; ruff/mypy/tsc/eslint/vitest all green

Refs: PLAN-v2.md §9 (T1–T43), todo-v2-final.md

apps/api/app/infrastructure/db/models_engine.py

@@ -82,6 +82,11 @@ class TaskPipelineStateRow(Base):
     #: A waived test pass must always be explainable: the reason is stored,
     #: never inferred (PLAN-v2 §3, green gate).
     waiver_reason: Mapped[str] = mapped_column(Text, default="", nullable=False)
+    #: The latest accepted diff (the writer caps it). The worktree is gone after the
+    #: merge, so the task page reads the diff from here.
+    last_diff: Mapped[str] = mapped_column(Text, default="", nullable=False)
+    #: The sha the merge landed on, once the state is COMPLETED.
+    merged_sha: Mapped[str] = mapped_column(String(64), default="", nullable=False)
     parent_task_id: Mapped[str | None] = mapped_column(
         ForeignKey("tasks.id", ondelete="SET NULL"), nullable=True
     )