runtime-feature-flags

# Runtime Feature Flags Use this checklist for temporary release toggles and risky features. It is self-contained: do not depend on the agent having read an ADR or public docs. Read `apps/backend/AGENTS.md` and `apps/web/AGENTS.md` when the change touches those subtrees. ## Invariants - The backend is authoritative. A disabled feature must not be reachable through HTTP, WebSocket, MCP, agent-tool, or background-job entry points. - A new release toggle is off in every shipped profile when it is merged. The disabled path preserves the existing behavior and fails closed before deriving data, writing state, dispatching work, or exposing a capability. - Effective values are ordered: explicit environment variable, SQLite override, then profile default. An explicit environment variable locks the admin UI. - Use one identity across layers: `features.<camelCaseKey>`, `KANDEV_FEATURES_<UPPER_SNAKE_CASE>`, a Go `FeaturesConfig` field, its JSON tag, and the matching frontend key. Never add a parallel flag map or switch. - Never reuse an identity recorded in the repository's append-only retired registry. Before relying on retirement, verify that `retiredRuntimeFlagIdentities` and its collision/completeness test exist; if they do not, add that runtimeflags infrastructure before removing a live flag. ## Add a flag Update these layers in the same change: 1. **Profile default:** add `KANDEV_FEATURES_<NAME>` under `features:` in the root `profiles.yaml`; use `prod: "...