Free-tier LLM dev-mode fixes + re-enable e2e product-flow specs

From the PR description

Summary

• Make free-tier Gemini usable from npm run dev (previously the guard rejected before assertFreeTierAllowed could even check the allowlist) and surface clearer errors when it refuses.
• Re-enable all four Playwright product-flow specs (projects, documents, chat, tabular) that had been wrapped in test.describe.skip() because selectors drifted from the current UI.

The e2e work is testid-only on the frontend (no behavior changes) - each load-bearing control in the four flows got a data-testid, and the specs were rewritten against the current architecture. Full suite is 13/13 green locally in ~1.4 min.

What changed in the e2e re-enablement

• projects - rename now goes through the row's kebab menu (clicking the row navigates into the project); create waits for the /projects/{id} redirect before asserting.
• documents - upload routes through AddDocumentsModal (file input is hidden inside the modal, only mounted when open); spec opens the modal, sets files, waits for Confirm to re-enable, clicks Confirm.
• chat - navigates through the project's assistant tab and uses the empty-state "+ Create New" to spawn a chat, which redirects to the chat detail page where ChatInput actually lives. Citation chips render as numeric <button>s (not literal [1]), so a citation-marker testid replaces the old regex.
• tabular - when invoked in project mode, AddNewTRModal auto-selects ready docs; uses the toolbar "Add Columns" button since the empty-state only renders with zero docs.

Setup gaps surfaced during this work

Documented in e2e/README.md:

• Test Supabase project needs backend/schema.sql applied (existing step, but its absence was the first wall I hit).
• backend/.env.test needs real Cloudflare R2 credentials (R2_ENDPOINT_URL, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_BUCKET_NAME) - the README previously only documented Supabase + Gemini. Free-tier R2 is sufficient for e2e usage.
• The Gemini key in .env.test may expire - rotate via https://aistudio.google.com/app/apikey when chat/tabular start failing with API_KEY_INVALID.

TECHDEBT.md is updated: the high-priority "Re-enable skipped Playwright specs" item is fully closed, with each spec moved to the Done section.

Test plan

• npm run test:e2e - 13/13 green locally
• CI green on this PR
• Spot-check the diff for any non-testid frontend changes that shouldn't be there (there shouldn't be - search for additions that don't contain data-testid or aria-label)

🤖 Generated with Claude Code