Flue preview reliability: rollout-safe gateway and minimal config CLI

[ZIJ]

Stack

Review this as a focused delta on the Flue evergreen, #489 (flue-native). It keeps one preview path and removes unused product surface.

Kept after review

• Rollout-compatible deploy tokens with org/agt/ep; the gateway epoch fence remains.
• Namespaced attribution keys, honest budget-overshoot documentation, and constant-time admin-secret comparison.
• Once-per-isolate provider binding; a tokenless request cannot overwrite an established binding.
• Manifest [vars] as the non-secret source of truth.
• Minimal oc agent secret set/list/delete; values are accepted only via --from-stdin and apply on the next deploy.
• Dashboard bigint body_bytes coercion so spilled events are retained.

Simplified after review

• Removed required token scopes, avoiding a grace-less break for already-deployed tokens.
• Removed the 500-line W8 dashboard editor and its duplicate web API/mock/schema surface.
• Removed the public TypeScript SDK config resource.
• Removed positional secret values and multiple config mutation paths.
• Removed best-effort X-OC-Session mutation; exact attribution waits for a race-free per-request Flue seam.

Validation

• gateway: 31/31 + typecheck
• Go command tests: go test ./cmd/oc/internal/commands
• Flue shim: 1/1 + build + typecheck
• TypeScript SDK: 20/20 + build
• changed dashboard schema lint + web typecheck + production build on Node 22.19

Full web lint still reports two pre-existing errors outside this diff in Browsers.tsx and SessionDetail.tsx.

Deferred

SDK/web config editors, live secret state, purpose-specific credentials, exact per-session spend, and other external-tenant GA controls are intentionally outside this preview-reliability slice.