Epic 5 Complete: Billing, Subscriptions, and Admin Features

Resolve all 5 deferred items from Epic 5 adversarial code review:
- Migration 124: Add CASCADE to subscriptionstatus enum drop (prevent orphaned references)
- Stripe rate limiting: In-memory per-user limiter (20 calls/60s) on verify-checkout-session
- Subscription request cooldown: 24h cooldown before resubmitting rejected requests
- Token reset date: Initialize on first subscription activation
- Checkout URL validation: Confirmed HTTPS-only (Stripe always returns HTTPS)

Implement Story 5.4 (Usage Tracking & Rate Limit Enforcement):
- Page quota pre-check at HTTP upload layer
- Extend UserRead schema with token quota fields
- Frontend 402 error handling in document upload
- Quota indicator in dashboard sidebar

Story 5.5 (Admin Seed & Approval Flow):
- Seed admin user migration with default credentials warning
- Subscription approval/rejection routes with admin guard
- 24h rejection cooldown enforcement

Story 5.6 (Admin-Only Model Config):
- Global model config visible across all search spaces
- Per-search-space model configs with user access control
- Superuser CRUD for global configs

Additional fixes from code review:
- PageLimitService: PAST_DUE subscriptions enforce free-tier limits
- TokenQuotaService: PAST_DUE subscriptions enforce free-tier limits
- Config routes: Fixed user_id.is_(None) filter on mutation endpoints
- Stripe webhook: Added guard against silent plan downgrade on unrecognized price_id

All changes formatted with Ruff (Python) and Biome (TypeScript).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

surfsense_web/components/new-chat/chat-header.tsx

@@ -1,7 +1,8 @@
 "use client";
 
 import { useCallback, useEffect, useState } from "react";
-import { useSetAtom } from "jotai";
+import { useAtomValue, useSetAtom } from "jotai";
+import { currentUserAtom } from "@/atoms/user/user-query.atoms";
 import { selectedSystemModelIdAtom } from "@/atoms/new-llm-config/system-models-query.atoms";
 import { ImageConfigDialog } from "@/components/shared/image-config-dialog";
 import { ModelConfigDialog } from "@/components/shared/model-config-dialog";
@@ -24,6 +25,9 @@ interface ChatHeaderProps {
 }
 
 export function ChatHeader({ searchSpaceId, className }: ChatHeaderProps) {
+	const { data: currentUser } = useAtomValue(currentUserAtom);
+	const isAdmin = !!currentUser?.is_superuser;
+
 	// Reset system model selection when search space changes
 	const setSelectedSystemModelId = useSetAtom(selectedSystemModelIdAtom);
 	useEffect(() => {
@@ -129,12 +133,12 @@ export function ChatHeader({ searchSpaceId, className }: ChatHeaderProps) {
 				<SystemModelSelector className={className} />
 			) : (
 				<ModelSelector
-					onEditLLM={handleEditLLMConfig}
-					onAddNewLLM={handleAddNewLLM}
-					onEditImage={handleEditImageConfig}
-					onAddNewImage={handleAddImageModel}
-					onEditVision={handleEditVisionConfig}
-					onAddNewVision={handleAddVisionModel}
+					onEditLLM={isAdmin ? handleEditLLMConfig : undefined}
+					onAddNewLLM={isAdmin ? handleAddNewLLM : undefined}
+					onEditImage={isAdmin ? handleEditImageConfig : undefined}
+					onAddNewImage={isAdmin ? handleAddImageModel : undefined}
+					onEditVision={isAdmin ? handleEditVisionConfig : undefined}
+					onAddNewVision={isAdmin ? handleAddVisionModel : undefined}
 					className={className}
 				/>
 			)}