feat(integration): prepaid billing, engine UI, credits console, direct tasks, v2 final

- Prepaid credit system: org wallet, debit on usage, chat gate, admin credit console
- Engine UI: /manager, /tasks, /tasks/[id], /workforce, /dashboard, /traces pages
- Direct task creation (HTTP POST /tasks, MCP tasks_create) at pending_manager_review
- Pause/resume/cancel/answer actions in engine API and UI
- Employee cap (7 per org default), review pipeline guard (active reviewer required)
- Scheduler: wide window prevents org starvation; archived employees excluded from cap
- Tenant isolation: project-id cross-org 404, engine never uses another tenant's sandbox
- Order route fix: manager built with pipeline states + employee profiles
- Contract extension: ModelGrantPort.get_org_policy with DefaultOrgPolicy
- Engine event types in @agy/contracts (task.step, task.gate, run.log, run.tool, team.changed)
- api-engine.ts typed client; api-credit.ts client
- Alembic migration c4d5e6f7a8b9: prepaid credit + engine UI tables
- 859 tests passed, 1 skipped; ruff/mypy/tsc/eslint/vitest all green

Refs: PLAN-v2.md §9 (T1–T43), todo-v2-final.md

apps/api/app/infrastructure/repositories/audit.py

@@ -10,6 +10,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.application.ports.audit import UsageAggregate, UsageBreakdown, UsageRecord
 from app.domain.ai_control.models import RateUnit
 from app.domain.audit.models import AuditEvent, ErrorEvent, QualityMetric, Span, Trace
+from app.domain.base import new_id
 from app.infrastructure.db.models import (
     AuditEventRow,
     ErrorEventRow,
@@ -18,6 +19,7 @@ from app.infrastructure.db.models import (
     TraceRow,
     UsageEventRow,
 )
+from app.infrastructure.repositories.credit import CreditLedgerRepository
 
 
 def _audit_to_domain(row: AuditEventRow) -> AuditEvent:
@@ -107,14 +109,26 @@ class AuditRepository:
 
 
 class UsageLedgerRepository:
-    """Concrete ``UsageLedgerPort``. The ledger is the billing source of truth."""
+    """Concrete ``UsageLedgerPort``. The ledger is the billing source of truth.
+
+    Prepaid: every usage row also debits its organization's wallet, once, in the
+    same transaction (the debit is keyed on the usage row's id). The ledger stays
+    the source of truth; the wallet is the balance it leaves behind.
+    """
 
     def __init__(self, session: AsyncSession) -> None:
         self.session = session
 
-    async def record(self, *, usage: UsageRecord) -> None:
+    async def record(self, *, usage: UsageRecord) -> float | None:
+        """Append one usage row, debit the wallet for it, return the new balance.
+
+        Both writes share the caller's transaction, so a rolled-back request leaves
+        neither behind. Returns ``None`` when the row cost nothing and nothing was
+        debited.
+        """
         total = usage.total_price or (usage.quantity * usage.unit_price)
         row = UsageEventRow(
+            id=new_id(),
             organization_id=usage.organization_id,
             project_id=usage.project_id,
             user_id=usage.user_id,
@@ -129,6 +143,12 @@ class UsageLedgerRepository:
         )
         self.session.add(row)
         await self.session.flush()
+        debit = await CreditLedgerRepository(self.session).debit_for_usage(
+            organization_id=usage.organization_id,
+            usage_event_id=row.id,
+            amount=total,
+        )
+        return debit.balance_after if debit is not None else None
 
     async def breakdown(
         self,