Phase 5: platform feature-flags CRUD, impersonation, billing catalogue

Three new platform screens on top of the Phase 1-4 work.

Feature flags (/feature-flags) — platform-wide flag registry. New route +
lib/arcadia/feature-flags.ts, capability platform.feature_flags, nav under
Automation. List/create/edit/delete with a per-row default toggle; pairs with
the Phase-4 per-tenant override tab.

Impersonation — "Impersonate" action on active users. Entirely client-side
token swap in session.ts (beginImpersonation parks the operator's session +
API token and swaps to the impersonation token; endImpersonation restores it),
with a sticky "Viewing as <email> — Stop" banner in the shell driven by the
JWT's impersonated_by claim. Stop is client-side because the impersonation
token carries the target's roles and can't reach the admin-gated /stop
endpoint; impersonation is stateless JWT so restoring the parked token is
sufficient.

Billing (/billing) — replaced the coming-soon stub with the real plan
catalogue from GET /billing/plans (lib/arcadia/billing.ts). Per-tenant plan
assignment stays on the tenant detail page; Entitlements + Apps remain honestly
marked "Soon".

Verified in-browser with real backend; typecheck adds zero errors (36→36).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/lib/capabilities.ts

@@ -39,6 +39,7 @@ export type Capability =
   | "platform.search"
   | "platform.ai"
   | "platform.integrations" // external-API registry (keys/budgets) on the gateway
+  | "platform.feature_flags"
   // Special — always-on; not gated.
   | "always.assistant"
   | "always.profile"
@@ -84,6 +85,7 @@ const PLATFORM_ADMIN_CAPS: Capability[] = [
   "platform.search",
   "platform.ai",
   "platform.integrations",
+  "platform.feature_flags",
 ]
 
 const ALWAYS_CAPS: Capability[] = ["always.assistant", "always.profile"]
@@ -135,6 +137,7 @@ export const ROUTE_CAPABILITY: Record<string, Capability> = {
   "/search": "platform.search",
   "/ai": "platform.ai",
   "/integrations": "platform.integrations",
+  "/feature-flags": "platform.feature_flags",
 
   "/assistant": "always.assistant",
   "/profile": "always.profile",