production_qa plan switch and project settings

## Requirement (verbatim) 7. "Measurement is always collected (deployments, incidents, linkage, regression deltas, the ledger edges). Every behaviour change — filing a task, filing a revert, running probes — is behind the plan feature `production_qa` with org override and per-project opt-in. Dogfood on the Jaah project first." Operator decision D9: "OFF on every plan and for every org and project, Jaah included. An operator enables Jaah by hand in the console after release, through the org override and the project opt-in." D12: revert policy per project `off` / `draft` / `auto-file`. Design: architecture artifact of Task 12249, §3 projects/plan columns, §4 `gate.state`, §11 "Project settings › Production QA" and operator plane. Columns already exist (schema child). ## Scope (architecture C2) - `production_qa` as a `SwitchSpec` plan switch in `plan_terms.py` (org override → plan → default false), mirrored in web `lib/planSwitches.tsx`, the plan editor (`PlanFields.tsx`) and org Overrides (`OverridesTab.tsx`). - `gate.state(session, project) -> GateState(enabled, reason)` with reasons `production_qa_off` / `project_not_opted_in`. - Project fields accepted by `PUT /api/projects/{id}` (`projects:edit`): `production_qa_enabled` (stamps `production_qa_enabled_by`; refused 409 with a clear message when the org switch is off), `production_environment`, `deploy_workflows`, `revert_policy`, regression window/thresholds. - Project settings › **Production QA** section: opt-in toggle (disabled with "Off for this org" when the switch is off), production environment, deploy workflows, revert policy, regression thresholds/window, and empty, clearly named slots where siblings add "Connect deploys" (deploy ingestion child), "Create default automations" (incident→task child) and probe editors (probes child). Follow `docs/standards/ui-style-guide.md` (edit in place) and `docs/standards/ui-copy-standards.md`. Credentials & reach: - UI checks on dev — `org/console/dev-login` (org Admin), `https://dev.jaah.ai` — credential **verified** (`credential_get` returned base_url/login/password; values not printed). Environment **deferred** for this node: `dev.jaah.ai` resolves to private 10.60.x addresses and HTTPS timed out from the architect's node; operator R4: run from a tailnet node - AC-5/19/27 on the Jaah project — `org/console/dev-login`; Jaah repo webhook config needs repo admin — **deferred** — same tailnet constraint; the repo webhook is configuration the operator adds in GitHub (PRD §6 allows) - AC-29 gates — worktree only — **verified** Out of scope: Do NOT turn `production_qa` on for any plan, org or project in code, seeds or migrations, Jaah included (D9). Do NOT add an org-level trigger quota or plan term (D6). Do NOT add a migration (schema child owns all DDL). Do NOT build Connect deploys, default automations or probe editors (sibling children). Epic out of scope (verbatim): "building an APM or log store; replacing the customer's monitor; auto-merging a revert without the project's policy; any scoring or ranking logic (the outcome ledger epic reads the states this epic writes)." Done means: - AC-25: "`production_qa` appears as a plan switch, as an org override in the operator plane, and as a per-project opt-in toggle in project settings, all on dev. It is OFF on every plan, every org and every project at release (D9)." — open each surface on dev (tailnet node) or, while dev is unreachable, the local console with screenshots; tightened: the disabled opt-in shows the reason word "Off for this org", not just a greyed control. - `gate.state` unit tests over the three feature states (OFF; ON + not opted in; ON + opted in) and override-beats-plan precedence. - AC-27 (console half): "an operator can turn the feature on for the Jaah org and project purely through the console (no SQL, no CLI)" — e2e or route test of override → opt-in through the UI/API only. (AC-27's behaviour half — AC-5/19/23 — is verified at Finish.) - Settings section readable at 390 px with no horizontal page scroll. - AC-29: `./dc check quick` green; changed-area tests green; merge lane full gate green.