feat(billing): no model-class gate; free allowance becomes $0.10/day

Operator policy 2026-11-01: every subscription may call any model, and the free tier resets daily.

Model gate removed (api/ai-gateway.py)
  `plan == 'free' and model_weight > 1 -> 403 "Advanced models require Pro"` ran before any money
  logic, so a free-plan account holding $1086 of purchased credit was refused and told to upgrade.
  A model tier is not something we sell: the allowance and the USD balance bound spend. A caller who
  cannot pay now gets the honest 429 (with period + needed amount). model_weight survives only for
  track_usage() analytics.

Free allowance: $0.50/month -> $0.10/day
  ~$3/month retail = $2.14/month of provider cost at 1.4x markup, ~6x the previous giveaway and
  still bounded per member (the 50-slot invite cap bounds the total; at full occupancy ~$107/mo or
  $2.14/user at 100% utilisation).

The window is policy, not code:
  - admin/data/pricing-policy.json: free_tier_usd=0.1, free_tier_period="day"
  - wx11_billing: FREE_TIER_PERIOD, allowance_window(plan) (day for free, month for paid),
    period_start(window), spend_usd(session, window) — one definition used by BOTH the gateway and
    the billing API (the old month_spend_usd duplicate is what let them drift before)
  - gateway + /api/billing/subscription now report the same window; plan_allowance gains `period`
  - dashboard.html, newOS4 module-billing, chatstudio account panel say "today" when period=day
  - published copy: index.html, pricing.html (card + compare table + how-usage-works), i18n planFree1,
    admin/docs/ai-gateway.html
  - verify-public-claims.py asserts the number AND the period per plan: a right number on the wrong
    window is the same defect as a wrong number

newOS4 bundle rebuilt (module-billing), LATEST_VER v4.6.135 -> v4.6.136, main.html cache keys bumped.

Proof:
  - verify-public-claims.py rc=0 (copy == policy == live billing API, including periods)
  - /api/billing/subscription: limit_usd 0.1, period "day", remaining 0.1
  - gateway: gemma4 200, kimi-k2-thinking 502 (gate gone; fake model => upstream 404)
  - smoke-auth PASS, smoke-gateway PASS (limit=$0.1 in the payload check)
  - live pages serve "$0.10 of AI usage / day", zero $0.50 left on index/pricing/subscriptions
  - allowance math: free cap_cost $0.0714/day, pro $7.7779/mo, team $23.35/mo, ent $77.85/mo

1 files changed, 1 insertions, 1 deletions

diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index 52cee36..0cc4dd2 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
     // Core module bundle loaded synchronously in main.html.
     // This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
 
-    const LATEST_VER = 'v4.6.135';
+    const LATEST_VER = 'v4.6.136';
     const CACHE = '?v=' + LATEST_VER;
     // Exposed so ext modules can register their own URL with the same cache-busting version
     // instead of an unversioned path the browser may already have cached (shell.js did).