AI suite: kill switch, quota guard, full audit log
Bring-your-own-key AI is now fully governed. Per-feature kill switch (default-on policy), per-school daily + monthly quota, full audit log of every AI call (who, when, feature, status, tokens, cost).
- Quota guard. Pre-flight check before every AI call; on deny, writes a QuotaExceeded audit row instead of making the HTTP call.
- Usage dashboard. KPI strip, cap ribbon, 12-month chart toggle (Cost / Tokens / Calls), per-feature breakdown, end-of-month forecast tile.
- Activity log. 50/100/200-row recent-calls view with feature + status filter and CSV export.
- AI feature gate. Per-feature on/off in a /admin/ai-features page. Master EnableAiTutor toggle. Fail-CLOSED.