Phase 5: platform feature-flags CRUD, impersonation, billing catalogue

Three new platform screens on top of the Phase 1-4 work.

Feature flags (/feature-flags) — platform-wide flag registry. New route +
lib/arcadia/feature-flags.ts, capability platform.feature_flags, nav under
Automation. List/create/edit/delete with a per-row default toggle; pairs with
the Phase-4 per-tenant override tab.

Impersonation — "Impersonate" action on active users. Entirely client-side
token swap in session.ts (beginImpersonation parks the operator's session +
API token and swaps to the impersonation token; endImpersonation restores it),
with a sticky "Viewing as <email> — Stop" banner in the shell driven by the
JWT's impersonated_by claim. Stop is client-side because the impersonation
token carries the target's roles and can't reach the admin-gated /stop
endpoint; impersonation is stateless JWT so restoring the parked token is
sufficient.

Billing (/billing) — replaced the coming-soon stub with the real plan
catalogue from GET /billing/plans (lib/arcadia/billing.ts). Per-tenant plan
assignment stays on the tenant detail page; Entitlements + Apps remain honestly
marked "Soon".

Verified in-browser with real backend; typecheck adds zero errors (36→36).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/lib/arcadia/feature-flags.ts

@@ -0,0 +1,51 @@
+// Platform-wide feature flags — the registry of flags that exist across the
+// whole deployment. A tenant then overrides any of these under its detail page
+// (see tenant-detail/feature-flags-tab). Backend: /api/v1/admin/feature-flags
+// (platform_admin only).
+
+import type { ArcadiaClient } from "@crema/arcadia-core-client"
+
+export interface PlatformFlag {
+  id: string
+  key: string
+  description: string | null
+  enabled_by_default: boolean
+  inserted_at?: string
+  updated_at?: string
+}
+
+export type PlatformFlagInput = {
+  key?: string
+  description?: string | null
+  enabled_by_default?: boolean
+}
+
+export async function listPlatformFlags(arcadia: ArcadiaClient): Promise<PlatformFlag[]> {
+  const res = await arcadia.GET<{ data: PlatformFlag[] }>("/api/v1/admin/feature-flags")
+  return res.data
+}
+
+export async function createPlatformFlag(
+  arcadia: ArcadiaClient,
+  input: PlatformFlagInput,
+): Promise<PlatformFlag> {
+  const res = await arcadia.POST<{ data: PlatformFlag }>("/api/v1/admin/feature-flags", {
+    body: { flag: input },
+  })
+  return res.data
+}
+
+export async function updatePlatformFlag(
+  arcadia: ArcadiaClient,
+  id: string,
+  input: PlatformFlagInput,
+): Promise<PlatformFlag> {
+  const res = await arcadia.PUT<{ data: PlatformFlag }>(`/api/v1/admin/feature-flags/${id}`, {
+    body: { flag: input },
+  })
+  return res.data
+}
+
+export async function deletePlatformFlag(arcadia: ArcadiaClient, id: string): Promise<void> {
+  await arcadia.DELETE(`/api/v1/admin/feature-flags/${id}`)
+}