[Admin][API] Runtime kill switch for platform-paid AI (platform_settings override)

[serge-ivo]

Follow-up from #32 (PR #43). Today the only lever to stop platform-paid AI is editing PLATFORM_AI_ENABLED in wrangler.toml + redeploy.

Add GET/PUT /v1/admin/settings/platform-ai backed by a platform_settings row that overrides the env default at runtime, so the operator can toggle platform-paid AI without a deploy. Wire the runtime checks (agent-do.ts:72, routes/instances-translation.ts) to consult the override. Audit-log the toggle (recordAdminAction). Known side effect to warn on: OFF → embeddings/summaries/translation no-op (RAG goes dark until a BYOK-embedding path exists).

Part of the PAGS Admin Portal epic (#27). Depends on #28.

[serge-ivo]

Shipped in 2684035 (CI green; the API deploy applied migration 0081).

Verified before building: platform_settings did not exist. PLATFORM_AI_ENABLED
is consulted in exactly two places — AgentDO.getStorageEngine (which is what feeds the
storage engine's AI, so it covers both recordPlatformUsage call sites in
agent-storage/vectors.ts and summaries.ts) and routes/instances-translation.ts
(twice in one handler). The issue's pointer to agent-do.ts:72 is now line ~110, same
code.

What it governs, explicitly. env.AI only — the calls ledgered as
provider="platform" (embeddings, summaries, translation). BYOK is untouched: a
user's Anthropic key, and Workers AI run against the user's own Cloudflare account via
runUserWorkersAi, is their spend and keeps working. Chat is BYOK, so flipping this off
never stops anyone talking to their agent, and translation already falls back to BYOK, so
it degrades rather than dies. The real cost of OFF is the one the issue named:
embeddings/summaries no-op, so RAG goes dark for new content. That warning ships in the
same payload as the switch, so the UI can't render one without the other.

Immediacy vs the hot path — resolved by scoping the read to the WORK, never to time.

• No TTL cache. A warm Worker isolate outlives many requests, so even a "short" TTL is
  unbounded from the operator's point of view — and a kill switch that kills in a minute
  isn't one. requireUser's suspension lookup made the identical call for the identical
  reason.
• The read is hoisted to the unit of work instead. getStorageEngine is now async
  and resolves it once per engine, so a repo-ingest tick that embeds 60 chunks pays for
  one lookup, not 60; the translation handler resolves once for both its attempts. The
  await is deliberately in the type — a synchronous fallback would be a second, staler
  source of truth for the same question.
• The lookup itself is a single-row PK read on a table with a handful of rows: the cost
  the platform already pays per authenticated request for users.suspended.

Failure mode. On a D1 error the env default governs, matching isSuspended's
documented fail-open — a blip must not silently change platform behaviour. Stated plainly
because it cuts the other way here: an override of OFF does not survive a D1 outage, so
PLATFORM_AI_ENABLED remains the hard, D1-independent backstop. A junk stored value is
likewise treated as no override rather than as false, so a half-written row can't take
RAG dark platform-wide.

Routes. GET/PUT /v1/admin/settings/platform-ai. enabled: null clears the override
and hands control back to the deployed default (rather than pinning a value that silently
contradicts the next deploy). PUT rejects a non-boolean instead of coercing — "false" is
truthy in JS, and an operator whose kill switch does the opposite of what they typed is the
worst outcome available here. Both handlers call requireAdmin themselves (#108 still
open, so nothing upstream is assumed), with the authorization boundary asserted per route,
and the flip is audited via recordAdminAction with before/after state.

Also: /v1/admin/spending now reports the resolved value plus its provenance. Reading
the env var there would have reported the opposite of reality exactly when someone is
looking at that page. docs/architecture.md updated in the same commit.

Admin UI for the toggle is out of scope here (another agent owns store/admin/**) — the
API returns {enabled, source, envDefault, override, updatedAt, updatedBy, warning}, which
is everything that surface needs.