#9741 fix(billing): withhold hosted Fal.ai video generation from free-plan payers

Summary

• Free-plan payers without prepaid credits can no longer run the Fal.ai video tool on Sim's hosted key. A workspace BYOK Fal.ai key, or a key passed to the block, still works on any plan
• New requiresPaidPlan flag on ToolHostingConfig, checked in injectHostedKeyIfNeeded after the BYOK lookup and before a hosted key is acquired; the refusal is a 402 HostedKeyRequiresPaidPlanError telling the user to upgrade or add their own key
• The verdict is the existing Chat plan gate, moved to payerHasPaidAccess (payerHasChatAccess stays as its named alias for the Chat callers), read from the run's billing attribution or, for a surface without one, the workspace payer
• Hosted video was being farmed through throwaway free accounts, each spending its free allowance on a couple of video generations. Chat's media tools were already closed to free payers by the Chat gate; workflows were the remaining path

Type of Change

• Bug fix

Testing

• tools/index.test.ts requiresPaidPlan: a payer without paid access is refused before a hosted key is acquired or the provider is called; a paid payer gets the hosted key; a free payer's own BYOK key runs without a plan check. The refusal test fails with the gate removed
• biome on changed files; type-check and audits in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)