Phase 5: platform feature-flags CRUD, impersonation, billing catalogue

Three new platform screens on top of the Phase 1-4 work.

Feature flags (/feature-flags) — platform-wide flag registry. New route +
lib/arcadia/feature-flags.ts, capability platform.feature_flags, nav under
Automation. List/create/edit/delete with a per-row default toggle; pairs with
the Phase-4 per-tenant override tab.

Impersonation — "Impersonate" action on active users. Entirely client-side
token swap in session.ts (beginImpersonation parks the operator's session +
API token and swaps to the impersonation token; endImpersonation restores it),
with a sticky "Viewing as <email> — Stop" banner in the shell driven by the
JWT's impersonated_by claim. Stop is client-side because the impersonation
token carries the target's roles and can't reach the admin-gated /stop
endpoint; impersonation is stateless JWT so restoring the parked token is
sufficient.

Billing (/billing) — replaced the coming-soon stub with the real plan
catalogue from GET /billing/plans (lib/arcadia/billing.ts). Per-tenant plan
assignment stays on the tenant detail page; Entitlements + Apps remain honestly
marked "Soon".

Verified in-browser with real backend; typecheck adds zero errors (36→36).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/lib/arcadia/billing.ts

@@ -0,0 +1,26 @@
+// Billing — the plan catalogue (what plans tenants can be on). Per-tenant plan
+// assignment lives on the tenant detail page; this is the platform-level view
+// of what's on offer. Backend: /api/v1/billing/plans.
+
+import type { ArcadiaClient } from "@crema/arcadia-core-client"
+
+export interface PlanMeter {
+  meter_key: string
+  included_units: number | null
+  overage_price_cents: number | null
+}
+
+export interface Plan {
+  name: string
+  slug: string
+  description: string | null
+  meters: PlanMeter[]
+  pricing: unknown[]
+  billing_track: string
+  trial_days: number
+}
+
+export async function listPlans(arcadia: ArcadiaClient): Promise<Plan[]> {
+  const res = await arcadia.GET<{ data: Plan[] }>("/api/v1/billing/plans")
+  return res.data
+}

app/lib/arcadia/feature-flags.ts

@@ -0,0 +1,51 @@
+// Platform-wide feature flags — the registry of flags that exist across the
+// whole deployment. A tenant then overrides any of these under its detail page
+// (see tenant-detail/feature-flags-tab). Backend: /api/v1/admin/feature-flags
+// (platform_admin only).
+
+import type { ArcadiaClient } from "@crema/arcadia-core-client"
+
+export interface PlatformFlag {
+  id: string
+  key: string
+  description: string | null
+  enabled_by_default: boolean
+  inserted_at?: string
+  updated_at?: string
+}
+
+export type PlatformFlagInput = {
+  key?: string
+  description?: string | null
+  enabled_by_default?: boolean
+}
+
+export async function listPlatformFlags(arcadia: ArcadiaClient): Promise<PlatformFlag[]> {
+  const res = await arcadia.GET<{ data: PlatformFlag[] }>("/api/v1/admin/feature-flags")
+  return res.data
+}
+
+export async function createPlatformFlag(
+  arcadia: ArcadiaClient,
+  input: PlatformFlagInput,
+): Promise<PlatformFlag> {
+  const res = await arcadia.POST<{ data: PlatformFlag }>("/api/v1/admin/feature-flags", {
+    body: { flag: input },
+  })
+  return res.data
+}
+
+export async function updatePlatformFlag(
+  arcadia: ArcadiaClient,
+  id: string,
+  input: PlatformFlagInput,
+): Promise<PlatformFlag> {
+  const res = await arcadia.PUT<{ data: PlatformFlag }>(`/api/v1/admin/feature-flags/${id}`, {
+    body: { flag: input },
+  })
+  return res.data
+}
+
+export async function deletePlatformFlag(arcadia: ArcadiaClient, id: string): Promise<void> {
+  await arcadia.DELETE(`/api/v1/admin/feature-flags/${id}`)
+}

app/lib/arcadia/users.ts

@@ -109,3 +109,41 @@ export async function setUserStatus(
 ): Promise<User> {
   return updateUser(arcadia, id, { status })
 }
+
+// --- Impersonation ---
+// The operator (platform/tenant admin) can act as another user for support.
+// `startImpersonation` returns a token scoped to the target; the client swaps
+// to it (see session.beginImpersonation). Stopping is a client-side restore of
+// the operator's parked session — the /stop endpoint can't be reached with the
+// impersonation token (it lacks admin), so we don't rely on it.
+
+export interface CanImpersonate {
+  can_impersonate: boolean
+  user: Pick<User, "id" | "email" | "status"> & { first_name?: string; last_name?: string }
+}
+
+export interface ImpersonationToken {
+  access_token: string
+  impersonated_by: string
+  expires_in: number
+}
+
+export async function canImpersonate(
+  arcadia: ArcadiaClient,
+  userId: string,
+): Promise<CanImpersonate> {
+  const res = await arcadia.GET<{ data: CanImpersonate }>(
+    `/api/v1/admin/impersonate/${userId}/can-impersonate`,
+  )
+  return res.data
+}
+
+export async function startImpersonation(
+  arcadia: ArcadiaClient,
+  userId: string,
+): Promise<ImpersonationToken> {
+  const res = await arcadia.POST<{ data: ImpersonationToken }>(
+    `/api/v1/admin/impersonate/${userId}`,
+  )
+  return res.data
+}