[codex] Persist production token batch group flag

[jjcc123312]

⚠️ 提交说明 / PR Notice

Important

This is a focused production-configuration follow-up to #481.

📝 变更描述 / Description

Problem and evidence

PR #481 was deployed successfully, but the production console still hid the batch token-group action. The public /api/status response showed token_batch_group_enabled: false because the feature flag intentionally defaults to false and the production deploy workflow did not persist an enabled value.

The production rollout has now completed safely: all Redis-sharing runtimes run the compatible code, old revisions drained beyond the 5-second quota flush interval and 60-second token-cache TTL, and newapi-console is serving the enabled capability at 100% traffic.

Scope and design

• Persist TOKEN_BATCH_GROUP_ENABLED=true in the deploy-console job.
• Include the flag in the workflow's gcloud --update-env-vars payload on every future console revision.
• Keep router deployment untouched; router already has the compatible cache protocol and is not the capability owner for this console UI feature.
• Clarify the rollout document while retaining the safe generic .env.example default of false.

Impact and risks

This changes only production console deployment configuration and rollout documentation. It does not change Go runtime behavior, database schema, Redis data, router deployment, or website deployment. The live console flag is already enabled out of band, so merging this PR prevents future console deploys from losing that state.

Multi-node safety remains unchanged: the cache protocol was deployed fleet-wide before the flag was enabled.

🚀 变更类型 / Type of change

• 🐛 Bug 修复 (Bug fix)
• ✨ 新功能 (New feature)
• ⚡ 性能优化 / 重构 (Refactor)
• 📝 文档更新 (Documentation)

🔗 关联任务 / Related Issue

• Follow-up to [codex] Add batch token group editing #481

✅ 提交前检查项 / Checklist

• 人工确认: 描述已整理为可审查的工程说明。
• 非重复提交: 这是 [codex] Add batch token group editing #481 生产 rollout 的独立配置跟进。
• 变更理解: 已确认 workflow 仅向 console job 传递该变量。
• 范围聚焦: 仅修改 workflow 与对应 rollout 文档。
• 本地验证: YAML 解析、git diff --check 和生产验证均通过。
• 安全合规: 未包含凭据或敏感值。

📸 运行证明 / Proof of Work

• Production console revision: newapi-console-batchgroup-e62d0108e3c6, 100% traffic.
• https://console.flatkey.ai/api/status: token_batch_group_enabled: true.
• Production /keys UI: selecting a token shows the 更新分组 bulk action.
• Router remains at 100% on newapi-router-20260723-130619-e62d0108e3c6.
• Workflow YAML parsed successfully with Ruby Psych.
• git diff --check passed.
• GitNexus: low risk, 2 config/doc files, no indexed runtime symbols or processes.

Deployment recommendation

• Router deploy: not required.
• Reason: only the production console workflow env payload and documentation change.
• Other deploy targets: no immediate deploy required; the live console is already enabled. Future approved console deployments will retain the flag. Website, Terraform, Cloudflare, and staging are not involved.
• Risk / validation: verify the next console deploy reports token_batch_group_enabled: true; do not approve a router job solely for this PR.