feat(integration): wire v2 workstreams together (engine policy/budget, sandbox, tenant checks, order route, docs)

Engine honours org policy and monthly budget, legacy runner skips engine tasks,
sandbox session provisioned on demand, project fallback for threads, reviewer
fallback, tenant checks on project ids, memory reflection respects grants,
expiry worker, MCP pipeline_status, login redirect, sharing settings, e2e smoke.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/app/application/container_org.py

@@ -32,6 +32,9 @@ from app.infrastructure.repositories.org_grants import (
 def build_memory(session: AsyncSession) -> MemoryPort:
     """The real memory service: recall, teach, and one reflection per task.
 
+    The reflection runs only on a model the organization was granted, so the
+    owner's grants decide which model learns on the organization's behalf.
+
     ``get_model_provider`` is resolved from ``container``'s namespace rather
     than from the registry directly: that module is what the composition root
     re-exports, so a deployment (or the test suite) that swaps the adapter in
@@ -39,15 +42,23 @@ def build_memory(session: AsyncSession) -> MemoryPort:
     """
     from app.application.container import get_model_provider
 
-    return build_memory_service(session, provider=get_model_provider())
+    return build_memory_service(
+        session, provider=get_model_provider(), grants=build_model_grants(session)
+    )
 
 
 def build_memory_service(
     session: AsyncSession,
     *,
     provider=None,
+    grants: ModelGrantPort | None = None,
 ) -> MemoryService:
-    """The same object, typed for the router (list, teach, pin, confirm, delete)."""
+    """The same object, typed for the router (list, teach, pin, confirm, delete).
+
+    ``grants`` is optional. The router never reflects, and a direct construction
+    without it keeps the routing-table path; the engine's path (``build_memory``)
+    always passes it.
+    """
     if provider is None:
         from app.application.container import get_model_provider
 
@@ -60,6 +71,7 @@ def build_memory_service(
         rate_cards=RateCardRepository(session),
         ledger=UsageLedgerRepository(session),
         provider=provider,
+        grants=grants,
     )