feat(ai): multi-key BYOK, real server class, real entitlement enforcement

Three pieces built together tonight since they're naturally linked (the
server-class proxy is the real entitlement enforcement chokepoint):

1. Multi-key BYOK (public class): several named provider profiles
   (name/baseUrl/model), each with its own key in lib/ai/key-store.ts
   (keyed by profile id, not a single fixed 'public' slot). The "Try it"
   pane lets you pick which saved profile answers each question - not one
   fixed default.

2. `server` class, real: app/api/ai/server/{models,chat} proxy through
   this app's own backend to AI_SERVER_BASE_URL - same-origin from the
   browser, no CORS/OLLAMA_ORIGINS story at all, standing in tonight for
   VNC's EU/CH-hosted infra with the real Ollama on this Mac (swapping to
   the real instance tomorrow is a config change).

3. Real entitlement enforcement (lib/ai/entitlement.ts), scoped to `server`
   only (not local/public, per the 2026-08-05 decisions): checkAndAssignSeat()
   re-validates on every /api/ai/server/chat call - first use auto-assigns a
   seat if any remain, further calls from an unlicensed user get a 402 with
   a specific reason. recordUsage() appends to an append-only metering
   ledger (timestamp/user/model/tokens/latency) that IS the billing record.
   Admin data endpoints at /api/admin/ai/entitlement (seat total, revoke) -
   the visual admin console is a separate, not-yet-built task.

Two real bugs found and fixed during verification, not just claimed fixed:
- /api/ai/policy never actually added 'server' to entitlement.classes even
  when AI_SERVER_BASE_URL was set (only the type comment was updated) - the
  Server radio option silently never appeared until this was caught live.
- The new routes used readStalwartAuthContext(0) (hardcoded slot, SSO/reauth-
  specific) instead of getStalwartCredentials() (the general multi-slot
  session resolver every other authenticated route uses) - reachable but
  wrong, and would have hidden a real auth gap behind "works on my slot".

Verified end-to-end for real: built + ran the actual server, logged in via
the real (non-demo) auth flow, selected Server, listed the real Ollama
models through the proxy, asked "Reply with exactly the words: SERVER CLASS
WORKS" and got back exactly that - plus confirmed on disk (not just in the
UI) that data/admin-state/ai-entitlement.json recorded the seat assignment
and ai-metering.jsonl recorded real prompt/completion token counts and
latency from the actual model call. Rejection-path logic (seat limit
reached, zero seats configured, revocation) covered by 5 new unit tests
rather than a second live round trip. Full suite: typecheck clean, lint
clean, translations 48/48, production build succeeds.

app/api/admin/ai/entitlement/route.ts

@@ -0,0 +1,56 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireAdminAuth, getClientIP } from '@/lib/admin/session';
+import { auditLog } from '@/lib/admin/audit';
+import { logger } from '@/lib/logger';
+import { getEntitlementState, setSeatTotal, revokeSeat, readMeteringLedger } from '@/lib/ai/entitlement';
+
+export const runtime = 'nodejs';
+
+/**
+ * Admin-only data endpoints for the `server` AI class's real entitlement
+ * enforcement (lib/ai/entitlement.ts). This is the data plumbing only — the
+ * visual admin console (docs/AI-ASSISTANT-CONCEPT.md §6) is a separate,
+ * not-yet-built UI on top of these same endpoints.
+ */
+export async function GET(request: NextRequest) {
+  const result = await requireAdminAuth(request);
+  if ('error' in result) return result.error;
+
+  try {
+    const [state, ledger] = await Promise.all([getEntitlementState(), readMeteringLedger()]);
+    return NextResponse.json({ ...state, recentUsage: ledger }, { headers: { 'Cache-Control': 'no-store' } });
+  } catch (error) {
+    logger.error('ai entitlement read error', { error: error instanceof Error ? error.message : String(error) });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+export async function PUT(request: NextRequest) {
+  const result = await requireAdminAuth(request);
+  if ('error' in result) return result.error;
+  const ip = getClientIP(request);
+
+  let body: { seatsTotal?: unknown; revokeUsername?: unknown };
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: 'invalid JSON body' }, { status: 400 });
+  }
+
+  try {
+    if (typeof body.seatsTotal === 'number') {
+      const state = await setSeatTotal(body.seatsTotal);
+      await auditLog('ai.entitlement.seats_total', { seatsTotal: state.seatsTotal }, ip);
+      return NextResponse.json(state);
+    }
+    if (typeof body.revokeUsername === 'string' && body.revokeUsername) {
+      const state = await revokeSeat(body.revokeUsername);
+      await auditLog('ai.entitlement.revoke_seat', { username: body.revokeUsername }, ip);
+      return NextResponse.json(state);
+    }
+    return NextResponse.json({ error: 'seatsTotal or revokeUsername is required' }, { status: 400 });
+  } catch (error) {
+    logger.error('ai entitlement update error', { error: error instanceof Error ? error.message : String(error) });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}