feat: allow premium+ users to manage costs

- costs routes drop requireAdmin, keep auth + costs feature check
- useAuth exposes hasFeature(feature) based on entitlements
- tool-detail costs section gated by hasFeature('costs') instead of isAdmin

artifacts/api-server/src/routes/costs.ts

@@ -2,7 +2,7 @@ import { Router, type IRouter } from "express";
 import { eq, and } from "drizzle-orm";
 import { z } from "zod";
 import { db, toolsTable, toolCostsTable } from "@workspace/db";
-import { requireAuth, requireAdmin } from "../middleware/auth";
+import { requireAuth } from "../middleware/auth";
 import { requireFeature } from "../middleware/feature";
 import { writeAuditLog } from "../lib/audit";
 
@@ -43,7 +43,7 @@ router.get("/tools/:id/costs", async (req, res): Promise<void> => {
   res.json(costs);
 });
 
-router.post("/tools/:id/costs", requireAuth, requireFeature("costs"), requireAdmin, async (req, res): Promise<void> => {
+router.post("/tools/:id/costs", requireAuth, requireFeature("costs"), async (req, res): Promise<void> => {
   const toolId = Number(req.params.id);
   if (isNaN(toolId)) { res.status(400).json({ error: "Invalid id" }); return; }
 
@@ -71,7 +71,7 @@ router.post("/tools/:id/costs", requireAuth, requireFeature("costs"), requireAdm
   res.status(201).json(entry);
 });
 
-router.patch("/costs/:id", requireAuth, requireFeature("costs"), requireAdmin, async (req, res): Promise<void> => {
+router.patch("/costs/:id", requireAuth, requireFeature("costs"), async (req, res): Promise<void> => {
   const id = Number(req.params.id);
   if (isNaN(id)) { res.status(400).json({ error: "Invalid id" }); return; }
 
@@ -96,7 +96,7 @@ router.patch("/costs/:id", requireAuth, requireFeature("costs"), requireAdmin, a
   res.json(updated);
 });
 
-router.delete("/costs/:id", requireAuth, requireFeature("costs"), requireAdmin, async (req, res): Promise<void> => {
+router.delete("/costs/:id", requireAuth, requireFeature("costs"), async (req, res): Promise<void> => {
   const id = Number(req.params.id);
   if (isNaN(id)) { res.status(400).json({ error: "Invalid id" }); return; }