feat(integration): wire v2 workstreams together (engine policy/budget, sandbox, tenant checks, order route, docs)

Engine honours org policy and monthly budget, legacy runner skips engine tasks,
sandbox session provisioned on demand, project fallback for threads, reviewer
fallback, tenant checks on project ids, memory reflection respects grants,
expiry worker, MCP pipeline_status, login redirect, sharing settings, e2e smoke.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/tests/engine_fakes.py

@@ -15,12 +15,13 @@ from __future__ import annotations
 from dataclasses import dataclass
 
 from app.application.ports import ChatMessage, CommandResult, ModelHealth, ModelResponse
-from app.application.ports.model_grants import GrantedModel
+from app.application.ports.model_grants import DefaultOrgPolicy, GrantedModel, OrgPolicyView
 from app.application.ports.sandbox_provider import (
     SessionInfo,
     SnapshotInfo,
     WorkspaceInfo,
 )
+from app.core.config import settings
 
 
 @dataclass(slots=True, kw_only=True)
@@ -187,9 +188,16 @@ class FakeGrants:
     ``granted`` is either a list of model ids (all ``balanced``) or a mapping
     of id → neutral tier, so a test can have a "strong" and a "fast" model and
     assert the engine picked the right one.
+
+    ``policy`` is the owner's per-organization policy. ``None`` means the default
+    policy, built at call time from ``settings.engine_max_employees``.
     """
 
-    def __init__(self, granted: list[str] | dict[str, str] | None = None) -> None:
+    def __init__(
+        self,
+        granted: list[str] | dict[str, str] | None = None,
+        policy: OrgPolicyView | None = None,
+    ) -> None:
         if granted is None:
             self._tiers: dict[str, str] = {
                 "model-strong": "strong",
@@ -200,6 +208,7 @@ class FakeGrants:
         else:
             self._tiers = dict.fromkeys(granted, "balanced")
         self.checks: list[str] = []
+        self.policy = policy
 
     @property
     def granted(self) -> list[str]:
@@ -215,6 +224,12 @@ class FakeGrants:
         self.checks.append(ai_model_id)
         return ai_model_id in self._tiers
 
+    async def get_org_policy(self, organization_id: str) -> OrgPolicyView:
+        if self.policy is not None:
+            return self.policy
+        # Read at call time: a test may monkeypatch ``settings.engine_max_employees``.
+        return DefaultOrgPolicy(max_employees=settings.engine_max_employees)
+
     def grant(self, model_id: str, tier: str = "balanced") -> None:
         self._tiers[model_id] = tier