Add agent budget controls

[baraajack]

Summary

Adds tenant-isolated, agent-specific budget controls.

Included

• budget_controls table with RLS enforcement
• Agent-scoped budget configuration
• BudgetRepository for configuration lookup and spend evaluation
• Authorization deny path when budget threshold is reached
• New decision reason: "denied: budget exceeded"
• Budget configuration API endpoint
• Kill switch precedence preserved over budget decisions
• Decision logging preserved before response
• Idempotency preserved via existing decision log path
• Spend derived from existing agent_runs cost records

Not Included

• Tenant-wide budgets
• Per-tool budgets
• Separate spend ledger
• Alerts or notifications
• Dashboards
• Auto-remediation
• Changes to ingestion or observability paths

Validation

• Authorization service tests
• Authorization endpoint tests
• Full test suite passes
• Tenant isolation preserved
• Kill switch override verified