fix(server): pre-check credit balance before health-check AI analysis

The health-check endpoint runs the paid OpenAI analysis before charging
(failed analyses are intentionally not charged). Without a balance
pre-check, a user below HEALTH_CHECK_COST could trigger unlimited free
analyses with fresh idempotency keys.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/lib/billing.js

@@ -259,6 +259,15 @@ const getAvailableCredits = (account) => {
   return monthlyRemaining + Math.max(0, account.topupBalance);
 };
 
+// Pre-flight balance check for endpoints that must not run paid work
+// (e.g. OpenAI analyses) before the actual charge happens.
+const ensureSufficientCredits = (account, cost) => {
+  const available = getAvailableCredits(account);
+  if (available < cost) {
+    throw createInsufficientCreditsError(cost, available);
+  }
+};
+
 const buildBillingSummary = (account) => {
   return {
     entitlement: {
@@ -817,6 +826,7 @@ module.exports = {
   getBillingSummary,
   getEndpointResponse,
   getMonthlyAllowanceForPlan,
+  ensureSufficientCredits,
   isInsufficientCreditsError,
   runInTransaction,
   simulatePurchase,