feat(integration): prepaid billing, engine UI, credits console, direct tasks, v2 final

- Prepaid credit system: org wallet, debit on usage, chat gate, admin credit console
- Engine UI: /manager, /tasks, /tasks/[id], /workforce, /dashboard, /traces pages
- Direct task creation (HTTP POST /tasks, MCP tasks_create) at pending_manager_review
- Pause/resume/cancel/answer actions in engine API and UI
- Employee cap (7 per org default), review pipeline guard (active reviewer required)
- Scheduler: wide window prevents org starvation; archived employees excluded from cap
- Tenant isolation: project-id cross-org 404, engine never uses another tenant's sandbox
- Order route fix: manager built with pipeline states + employee profiles
- Contract extension: ModelGrantPort.get_org_policy with DefaultOrgPolicy
- Engine event types in @agy/contracts (task.step, task.gate, run.log, run.tool, team.changed)
- api-engine.ts typed client; api-credit.ts client
- Alembic migration c4d5e6f7a8b9: prepaid credit + engine UI tables
- 859 tests passed, 1 skipped; ruff/mypy/tsc/eslint/vitest all green

Refs: PLAN-v2.md §9 (T1–T43), todo-v2-final.md

apps/api/tests/test_workers.py

@@ -22,11 +22,13 @@ from httpx import AsyncClient
 
 from app.domain.base import utcnow
 from app.domain.identity.models import PlatformRole
+from app.infrastructure.db.models import OrganizationRow
 from app.workers import base as worker_base
 from app.workers.ai_runtime import AiRuntimeWorker
 from app.workers.billing import BillingWorker
 from app.workers.sandbox_gateway import SandboxGatewayWorker
 from tests.conftest import auth_header, signup
+from tests.legacy_tasks import legacy_task
 
 
 @pytest_asyncio.fixture(autouse=True)
@@ -89,25 +91,32 @@ async def _make_org_with_employee(
     return org_id, headers, project_id, employee_id
 
 
+async def _owner_of(session_factory, organization_id: str) -> str:
+    """The user who created an organization: the accountable creator of its tasks."""
+    async with session_factory() as session:
+        return (await session.get(OrganizationRow, organization_id)).owner_user_id
+
+
 # -- ai-runtime -------------------------------------------------------------- #
 
 
-async def test_ai_runtime_runs_a_task_nobody_clicked(client: AsyncClient):
-    """A task created without pressing "run" must still be picked up."""
+async def test_ai_runtime_runs_a_task_nobody_clicked(client: AsyncClient, session_factory):
+    """A task created without pressing "run" must still be picked up.
+
+    Decision D-D: the drain picks up pre-v2 tasks (no pipeline state), so the task is one
+    of those. A task made over HTTP is the engine's, and the scheduler takes it instead.
+    """
     org_id, headers, project_id, employee_id = await _make_org_with_employee(
         client, "worker-runtime@example.com"
     )
-    task_id = (
-        await client.post(
-            f"/api/organizations/{org_id}/tasks",
-            json={
-                "title": "کار بی‌صاحب",
-                "project_id": project_id,
-                "assigned_employee_id": employee_id,
-            },
-            headers=headers,
-        )
-    ).json()["id"]
+    task_id = await legacy_task(
+        session_factory,
+        org_id,
+        await _owner_of(session_factory, org_id),
+        title="کار بی‌صاحب",
+        project_id=project_id,
+        assigned_employee_id=employee_id,
+    )
 
     # Nothing has run it yet.
     detail = await client.get(
@@ -130,19 +139,21 @@ async def test_ai_runtime_runs_a_task_nobody_clicked(client: AsyncClient):
     assert runs[0]["status"] == "completed"
 
 
-async def test_ai_runtime_does_not_run_a_task_twice(client: AsyncClient):
-    """A closed task must not be re-run — re-running would double-bill."""
-    org_id, headers, project_id, employee_id = await _make_org_with_employee(
+async def test_ai_runtime_does_not_run_a_task_twice(client: AsyncClient, session_factory):
+    """A closed task must not be re-run — re-running would double-bill.
+
+    Decision D-D: a pre-v2 task (no pipeline state), because that is the drain's path.
+    """
+    org_id, _headers, project_id, employee_id = await _make_org_with_employee(
         client, "worker-runtime-twice@example.com"
     )
-    await client.post(
-        f"/api/organizations/{org_id}/tasks",
-        json={
-            "title": "کار یک‌باره",
-            "project_id": project_id,
-            "assigned_employee_id": employee_id,
-        },
-        headers=headers,
+    await legacy_task(
+        session_factory,
+        org_id,
+        await _owner_of(session_factory, org_id),
+        title="کار یک‌باره",
+        project_id=project_id,
+        assigned_employee_id=employee_id,
     )
 
     first = await AiRuntimeWorker().drain()
@@ -156,19 +167,21 @@ async def test_ai_runtime_does_not_run_a_task_twice(client: AsyncClient):
 # -- billing-worker ---------------------------------------------------------- #
 
 
-async def test_billing_roll_up_creates_a_draft_invoice(client: AsyncClient):
-    """Usage in the period must become exactly one draft invoice."""
+async def test_billing_roll_up_creates_a_draft_invoice(client: AsyncClient, session_factory):
+    """Usage in the period must become exactly one draft invoice.
+
+    Decision D-D: the usage comes from the drain, so the task is a pre-v2 one.
+    """
     org_id, headers, project_id, employee_id = await _make_org_with_employee(
         client, "worker-billing@example.com"
     )
-    await client.post(
-        f"/api/organizations/{org_id}/tasks",
-        json={
-            "title": "کار قابل صورتحساب",
-            "project_id": project_id,
-            "assigned_employee_id": employee_id,
-        },
-        headers=headers,
+    await legacy_task(
+        session_factory,
+        org_id,
+        await _owner_of(session_factory, org_id),
+        title="کار قابل صورتحساب",
+        project_id=project_id,
+        assigned_employee_id=employee_id,
     )
     assert (await AiRuntimeWorker().drain()).processed == 1, "the run must be metered"
 
@@ -190,19 +203,21 @@ async def test_billing_roll_up_creates_a_draft_invoice(client: AsyncClient):
     assert body[0]["amount"] > 0, "the invoice must carry the ledger's total"
 
 
-async def test_billing_roll_up_is_idempotent(client: AsyncClient):
-    """Two passes over the same period must not bill twice."""
+async def test_billing_roll_up_is_idempotent(client: AsyncClient, session_factory):
+    """Two passes over the same period must not bill twice.
+
+    Decision D-D: the usage comes from the drain, so the task is a pre-v2 one.
+    """
     org_id, headers, project_id, employee_id = await _make_org_with_employee(
         client, "worker-billing-twice@example.com"
     )
-    await client.post(
-        f"/api/organizations/{org_id}/tasks",
-        json={
-            "title": "کار یک‌بار صورتحساب",
-            "project_id": project_id,
-            "assigned_employee_id": employee_id,
-        },
-        headers=headers,
+    await legacy_task(
+        session_factory,
+        org_id,
+        await _owner_of(session_factory, org_id),
+        title="کار یک‌بار صورتحساب",
+        project_id=project_id,
+        assigned_employee_id=employee_id,
     )
     await AiRuntimeWorker().drain()