feat(integration): prepaid billing, engine UI, credits console, direct tasks, v2 final

- Prepaid credit system: org wallet, debit on usage, chat gate, admin credit console
- Engine UI: /manager, /tasks, /tasks/[id], /workforce, /dashboard, /traces pages
- Direct task creation (HTTP POST /tasks, MCP tasks_create) at pending_manager_review
- Pause/resume/cancel/answer actions in engine API and UI
- Employee cap (7 per org default), review pipeline guard (active reviewer required)
- Scheduler: wide window prevents org starvation; archived employees excluded from cap
- Tenant isolation: project-id cross-org 404, engine never uses another tenant's sandbox
- Order route fix: manager built with pipeline states + employee profiles
- Contract extension: ModelGrantPort.get_org_policy with DefaultOrgPolicy
- Engine event types in @agy/contracts (task.step, task.gate, run.log, run.tool, team.changed)
- api-engine.ts typed client; api-credit.ts client
- Alembic migration c4d5e6f7a8b9: prepaid credit + engine UI tables
- 859 tests passed, 1 skipped; ruff/mypy/tsc/eslint/vitest all green

Refs: PLAN-v2.md §9 (T1–T43), todo-v2-final.md

apps/api/tests/test_seed.py

@@ -127,13 +127,18 @@ async def test_platform_owner_is_not_joined_to_any_organization(
 
 
 async def test_seeded_install_can_use_the_product(
-    client: AsyncClient, seeded_install
+    client: AsyncClient, seeded_install, session_factory
 ):
     """The seed's platform rows are enough to create a project and run a task.
 
     A seed that satisfies the login test but leaves the catalogue empty would
     still fail the moment a developer tried anything real.
+
+    Decision D-D: the run is the legacy path's, so the task is a pre-v2 row (no pipeline
+    state). A task made over HTTP enters the engine and is refused by the run button.
     """
+    from tests.legacy_tasks import legacy_task
+
     login = await client.post(
         "/api/auth/login",
         json={
@@ -142,7 +147,8 @@ async def test_seeded_install_can_use_the_product(
         },
     )
     headers = auth_header(login.json()["access_token"])
-    org_id = (await client.get("/api/auth/me", headers=headers)).json()["organizations"][0]["id"]
+    me = (await client.get("/api/auth/me", headers=headers)).json()
+    org_id = me["organizations"][0]["id"]
 
     # The platform catalogue the seed installs must be visible to a tenant.
     templates = await client.get(
@@ -177,17 +183,14 @@ async def test_seeded_install_can_use_the_product(
         )
     ).json()["id"]
 
-    task_id = (
-        await client.post(
-            f"/api/organizations/{org_id}/tasks",
-            json={
-                "title": "کار seed",
-                "project_id": project_id,
-                "assigned_employee_id": employee_id,
-            },
-            headers=headers,
-        )
-    ).json()["id"]
+    task_id = await legacy_task(
+        session_factory,
+        org_id,
+        me["user"]["id"],
+        title="کار seed",
+        project_id=project_id,
+        assigned_employee_id=employee_id,
+    )
 
     run = await client.post(
         f"/api/organizations/{org_id}/tasks/{task_id}/runs",