feat(ai): clinic-wide AI kill-switch (admin-controlled)

- new org_ai_policy table + GET/PUT /api/ai/policy (read for any member,
  write owner/admin only); migration 0018
- /api/chat hard-blocks (403) when AI is off for the caller
- Settings → AI "Availability" section: enable AI, or disable for
  employees only (owners/admins keep access); read-only for non-admins
- sidebar, command palette and route guard hide/redirect the AI chat
  when it's disabled for the current user

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/drizzle/0018_clean_doctor_strange.sql

@@ -0,0 +1,8 @@
+CREATE TABLE "org_ai_policy" (
+	"organization_id" text PRIMARY KEY NOT NULL,
+	"ai_enabled" boolean DEFAULT true NOT NULL,
+	"disabled_for_employees" boolean DEFAULT false NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "org_ai_policy" ADD CONSTRAINT "org_ai_policy_organization_id_organization_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;

backend/drizzle/meta/_journal.json

@@ -127,6 +127,13 @@
       "when": 1781537419038,
       "tag": "0017_wealthy_northstar",
       "breakpoints": true
+    },
+    {
+      "idx": 18,
+      "version": "7",
+      "when": 1781537902724,
+      "tag": "0018_clean_doctor_strange",
+      "breakpoints": true
     }
   ]
 }