* feat: expose tenant data retention and show upgrade banner

Write plan retention onto the tenant via UpdateTenant, expose
dataRetentionPeriod on the API, and show a billing upgrade banner
when the UI looks past the window. The API is not restricted.

* feat: gate time pickers with a retention upgrade modal

Replace the post-query RetentionBanner with picker-native limits so out-of-bound ranges never apply.

* feat: show invoices on the billing and usage page

Add upcoming and previous invoice history above plan history, using Autumn-hosted invoice links for past charges.

* feat: show an upgrade card when member or tenant limits are reached

* feat: name upgrade limits after the current plan tier

* fix: drop the possessive from upgrade limit titles

* feat: offer pay-as-you-go and a sales call on the upgrade page

Hide legacy plans from the selector, drop annual billing, and send welcome-modal upgrades to the new Pay as you Go plan.

* feat: show usage meters and a single invoices table

Rebuild billing around Autumn balances and sparkline detail, and list the upcoming invoice as the first row of one invoices table.

* feat: open a two-screen Pay as you Go upgrade gate from tenant, member, and retention limits

Lead with the value of upgrading, send Upgrade straight to Stripe checkout, and keep Details as a secondary view of plan contents.

* feat: warn on high usage and send billing upgrade CTAs through the gate modal

Color meters at 75% and 95%, sort by current usage, and open the Pay as you Go pitch instead of jumping straight to Stripe or a second details screen.

* fix: populate task createdAt so fresh runs aren't flagged as outside retention

ToTask and ToTaskSummary left the required top-level createdAt at Go's zero
time, which serialized as 0001-01-01 and made the run page treat every
standalone task run as retention-expired. Also guard isBeforeRetention
against invalid or pre-epoch timestamps.

* feat: send sales-gated upgrades through Talk to Sales and add a compliance page

Rework the welcome modal around Pay as you Go, make SSO/audit/Prometheus
gates consistent, spell out Single Sign On, and add a cloud-only compliance
settings page with inactivity timeout and Trust Center links.

* feat: include billing usage limits in the header popover

The Limit reached menu only knew about tenant engine caps, so org features like users never appeared. Surface those usage rows and persist dismissals in localStorage so they stay hidden after refresh.

* feat: send legacy plan changes through sales instead of self-serve PAYG

Legacy subscriptions can no longer upgrade to Pay as you Go from the billing page; they get a Talk to sales CTA instead.

* feat: refresh PAYG upgrade copy and fold audit logs into compliance

The new pricing language should match across welcome, upgrade gates,
and enterprise unlocks, and compliance settings should live on one page.

* nits

* gate yo

* tool tip

* cleanup meters

* fix: satisfy prettier and eslint on PAYG billing UI

* refactor

* fix: build the usage table from shard counts

Autumn balances were the row source, so task runs could read 0 while the shard series already had usage.

* colors and fixes

* banner

* caption

* caption

* remove ugly label

* Rework the Pay as you Go upgrade gate.

Render the gate on the SetupCard dialog surface used by the onboarding,
welcome, and invoice dialogs, with small footer buttons. Titles are in
active voice and descriptions point at the upgrade instead of repeating
numbers. Below the header, two labelled tables compare Free with Pay as you
Go: metered usage (included per month, then overage priced from the plan
API) and plan limits. The table opens collapsed to the single gated row,
highlighted, with a "See full breakdown" toggle.

Pass the gated feature id from the usage meters so the usage gate can name
the resource. Give SetupCard dialogs a solid backing; the card's own fill is
translucent and page text bled through.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* nits

* fix: type tenant usage chart points so the frontend build compiles

The chart row was declared as { date: string } & Record<string, number>,
which no object literal can satisfy because date collides with the numeric
index signature. Widen the index signature to string | number via a shared
TenantChartPoint type.

* fix: match review notes for plan codes, the upgrade gate, and SSO copy

* fix: regenerate SDK clients for dataRetentionPeriod

* fix: format the generated TypeScript client with Prettier 3.9.6

* custom plan name

* fix import

---------

Co-authored-by: Alexander Belanger <alexander@hatchet.run>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>