Fail closed tenant platform activation

[OneClickPostFactory]

Purpose

Fix D22 from the 6 September 2026 reliability review: missing tenant platform settings must never silently enable publishing surfaces.

Previously loadTenantContext treated missing Threads, Instagram and LinkedIn flags as enabled via ?? true. A missing settings row or nullable field could therefore activate platforms the tenant had not explicitly enabled.

Changes

• Add one pure activePlatformsFromSettings policy.
• A platform is active only when its persisted *_enabled value is exactly boolean true.
• Missing settings objects, missing fields, null and false all fail closed.
• Wire loadTenantContext through the policy instead of platform-specific fallback defaults.
• Add regression coverage for missing, null, false, mixed and all-explicitly-enabled settings.
• Run that regression inside the complete npm test / npm run ci gate.
• Reconcile the reliability progress document with the already-merged D03 evidence.

Preserved boundaries

• No provider is re-enabled.
• Threads and Instagram hosted publication remain fail-closed.
• Facebook remains paused unless explicitly enabled, and its hosted publish path remains paused.
• No credentials, billing, queue, scheduling, source-ingestion or publication-ledger semantics are changed.
• No deployment is performed.

Acceptance evidence required

The full upstream npm run ci gate must pass on the exact PR head before merge. The D22 regression must prove:

1. {} enables no platforms;
2. null enables no platforms;
3. false enables no platforms;
4. mixed settings enable only explicit true entries;
5. all explicit true values preserve canonical platform order.

Base

This branch is based on upstream main after merged PR #4 at 033b9b578c120bec0b725311eba1db3d3bfe5530 and is not stacked on any unmerged work.