feat: enable AI Analysis in read-only mode with explicit feature flag

[crystalin]

Summary

This PR enables AI Analysis functionality in read-only dashboard mode when explicitly configured, while maintaining security for all other write operations.

Changes

Core Implementation

• ✅ Added environment variable for explicit opt-in
• ✅ Extended auth context with capability
• ✅ Implemented secure endpoint allowlist for AI Analysis operations (POST only)
• ✅ Updated UI tooltips to explain configuration requirements clearly
• ✅ Added GEMINI_API_KEY validation (trim whitespace, check length)

Testing

• ✅ Added comprehensive test coverage for various scenarios
• ✅ Tests verify that only AI Analysis endpoints are allowed in read-only mode
• ✅ Tests confirm other write operations remain blocked

Documentation

• ✅ Updated environment variables reference
• ✅ Added read-only mode section to AI Analysis guide
• ✅ Updated ADR-019 to document the security exception

Security Considerations

This implementation follows security best practices:

1. Explicit opt-in: Requires both and
2. Narrow allowlist: Only specific AI Analysis endpoints are excepted
3. Method restriction: Only POST requests to allowed endpoints
4. Rate limiting: Existing rate limits still apply
5. No key exposure: GEMINI_API_KEY remains server-only

Testing

• Unit tests pass
• TypeScript compilation successful
• Code review completed with high-priority issues addressed

Configuration

To enable AI Analysis in read-only mode:

GEMINI_API_KEY=your-key-here
AI_ANALYSIS_READONLY_ENABLED=true
AI_WORKER_ENABLED=true
# DASHBOARD_API_KEY not set (read-only mode)

Closes #[issue-number]

Co-Authored-By: Claude [email protected]