Enforce parent BYOK billing mode for hosted usage

[Obsecurus]

Summary

• add new billing mode user_api to enforce parent bring-your-own-key behavior
• block chat and AI trivia in hosted mode when a parent key is missing
• pass parent key per request to Claude Agent SDK for chat/build/mechanic runs
• update web UI to prompt parent for key, send key header, and handle missing-key errors
• switch Fly defaults to YAPPY_BILLING_MODE=user_api and update docs/examples
• add integration tests for BYOK guard behavior

Validation

• cd interview-app && npm run check
• cd interview-app && npm test