fix(quotas): unifier le décompte IA (BYOK, rollback) et combler les fuites

Centralise la réserve via ai-quota, corrige admin unavailable (-1), brancher les routes sans quota et le host-pays brainstorm, avec usage-meter élargi, noms de clusters, MCP et ajustements dashboard/insights.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/app/actions/mcp-keys.ts

@@ -4,6 +4,8 @@ import { auth } from '@/auth'
 import { prisma } from '@/lib/prisma'
 import { revalidatePath } from 'next/cache'
 import { createHash, randomBytes } from 'crypto'
+import { assertMcpAccess, isMcpTierAllowed } from '@/lib/mcp-access'
+import { getEffectiveTier } from '@/lib/entitlements'
 
 const KEY_PREFIX = 'mcp_key_'
 
@@ -62,6 +64,8 @@ export async function generateMcpKey(name: string): Promise<{ rawKey: string; in
   const session = await auth()
   if (!session?.user?.id) throw new Error('Unauthorized')
 
+  await assertMcpAccess(session.user.id)
+
   const user = await prisma.user.findUnique({
     where: { id: session.user.id },
     select: { id: true, name: true, email: true },
@@ -155,6 +159,13 @@ export type McpServerStatus = {
   url: string | null
 }
 
+export async function getMcpAccessStatus(): Promise<{ allowed: boolean; tier: string }> {
+  const session = await auth()
+  if (!session?.user?.id) return { allowed: false, tier: 'BASIC' }
+  const tier = await getEffectiveTier(session.user.id)
+  return { allowed: isMcpTierAllowed(tier), tier }
+}
+
 /**
  * Get MCP server status — mode and URL.
  */