Reconcile public frontend with current research runtime and fix review findings

[gilbertsahumada]

This brings the public frontend branch up to current main while preserving Juve's pages, authentication work and commit history. It fixes the review findings in #21 before that PR is integrated. This PR targets codex/landing-page; it must not be treated as a separate replacement frontend or an automatic merge to main. Live trading #22 is excluded.

• Require explicit API-key abilities on every protected product route. Empty, unrelated and legacy broad scopes no longer bypass authorization; read:agents is read-only and workspace-scoped. Existing keys are not automatically upgraded.
• Attribute budget charges to their actual commit month and reset generation. Cross-month/pre-reset refunds cannot credit current spending; old unknown-period reservations fail closed for credits. Durable Object SQLite upgrades retain rows.
• Reconcile both Drizzle histories and generated snapshots without changing published SQL hashes or timestamps. The migration wrapper serializes upgrades, applies older missing migrations by identity and rejects unknown history. Do not drop existing schemas. Stop old executors before upgrading.
• Fix the Node 22 timeout fixture and remove 21 generated Wrangler SQLite files from Git, retaining ignored local state.
• Document current responsibilities and the proposed authenticated product-to-research bridge, with an HTML comparison diagram. Next.js growth routes and the Hono Cloudflare product API currently coexist. Product agents and private research agents are not yet connected.

Validation: 232 tests passed on PostgreSQL and 232 on the local Supabase server, using disposable databases. Fresh, research-only and product-only migration histories preserve data and support repeat/concurrent application. Eight adapter tests passed on Node 22.22.0. Format, lint, workspace types, Next.js/Mastra builds and both Cloudflare Worker dry-run bundles passed. Drizzle generation reports no schema drift.

No hosted migration, deployment, paid research or live trading was performed. Browser preview of the local HTML diagram was blocked by browser policy; no visual/end-to-end frontend acceptance is claimed. The product-to-research authenticated mapping and UI data wiring remain a separate implementation step.

History: one merge commit retains both branches, followed by one correction commit per file. Review the correction commits separately from the already-reviewed main changes if useful.