feat/fix: AI credits, image validation, per-tenant moderation, atomic persistence

[popsman01]

Summary

This PR resolves four issues across the AI and billing subsystems.

---

hman38705#627 — Deduct credits proportional to actual AI token usage

Files: backend/src/services/AIService.ts, backend/src/services/BillingService.ts, backend/src/routes/ai.ts, backend/src/workers/index.ts

• Added BillingService.deductCreditsForTokens(userId, tokens) — 1 credit per token consumed.
• Updated AIService.generateContent to return { text, totalTokens } and read res.usageMetadata.totalTokenCount from the Gemini response.
• Credit deduction now happens post-call inside the service using the actual token count, replacing the flat-rate requireCredits('ai:generate') pre-call middleware on /ai/analyze-image.
• Updated all callers (generateCaption, generateReplies, analyzeContent, workers) to destructure { text } from the new return type.
• Tests: 6 tests — short/long token deduction, insufficient credits error, no-userId skip.

Closes hman38705#627

---

hman38705#628 — Validate image size before sending to Gemini API

Files: backend/src/services/geminiService.ts, backend/jest.config.js

• Added ValidationError class (extends GeminiServiceError, code VALIDATION_ERROR).
• analyzeImage now computes the decoded byte size from the base64 string (accounting for padding) and throws ValidationError for images exceeding the 20 MB limit before any API call is made.
• Added a dedicated gemini-validation Jest project that bypasses the global geminiService stub so tests run against the real implementation.
• Tests: 3 tests — below limit, exactly at limit, above limit.

Closes hman38705#628

---

hman38705#629 — Support per-tenant moderation sensitivity thresholds

Files: backend/src/services/ModerationService.ts, backend/src/services/DynamicConfigService.ts

• Added ConfigKey.MODERATION_SENSITIVITY to the DynamicConfigService enum.
• getSensitivity(tenantId?) now checks dynamicConfigService.get(tenant:${tenantId}:MODERATION_SENSITIVITY) first, then falls back to process.env.MODERATION_SENSITIVITY.
• Threaded tenantId through ModerationService.moderate(text, tenantId?) — fully backward-compatible (parameter is optional).
• Tests: 4 tests — high/low tenant thresholds, env fallback, two tenants receiving different thresholds for identical content.

Closes hman38705#629

---

hman38705#630 — Persist AI generation result inside the job transaction

Files: backend/src/workers/index.ts

• Imported withTransaction and TxClient from backend/src/lib/transaction.ts.
• persistAIResult now accepts an optional TxClient and uses upsert keyed on jobId (update: {} is a no-op) — prevents duplicate records when a retried job re-runs after a crash between generation and persistence.
• All 5 AI processors (generate-caption, generate-hashtags, generate-content, analyze-sentiment, translate-content) now call withTransaction(async (tx) => persistAIResult(job, output, tx)).
• Tests: 3 tests — success path, crash/error propagation, no-duplicate on retry.

Closes hman38705#630

---

Testing

All new tests pass:

• aiProportionalCredits.test.ts — 6 passing
• geminiImageValidation.test.ts — 3 passing
• moderationPerTenant.test.ts — 4 passing
• aiAtomicPersist.test.ts — 3 passing