Route manual reflection through inference admission

[oratis]

Summary

• make inference permits own a single idempotent usage settlement
• migrate account chat and gateway traffic to permit-owned settlement
• route manual /reflect through account admission, quota, lease, metering, and debit
• aggregate retry, cache, and desire-consolidation usage in reflection results
• preserve local/BYO-key and operator-funded shared-token behavior

Failure semantics

• billing/account-store admission or settlement failures fail closed with 503 billing_state_unavailable
• the permit always releases its renewable tenant turn lease
• a repeated settlement call within one request cannot double debit

Validation

• npm run typecheck
• npm test — 1444 passed, 1 skipped, 0 failed
• npm run build