feat: Feature flag system (targeting + kill-switches)

[joelpeace48-cell]

Background & current state

Risky features (ZK, asset payouts, token mode) need safe, controllable rollout and kill-switches. There's no feature-flag system; behavior is env-only and requires redeploys to change.

Goal

Add a feature flag system (env + runtime) with targeting and kill-switches, evaluated on both server and client.

Technical design

• Flag store (DB/Redis) with runtime updates; SDK for server (isEnabled(flag, context)) and client (hydrated safely). Targeting by org/user/percentage. Kill-switch flags for risky subsystems.
• Admin UI to toggle; audit changes (NEW-050/084).

Edge cases

• Flag store down → fall back to safe defaults (off for risky).
• Client/server divergence → server authoritative for security-sensitive flags.
• Stale cache → short TTL + push invalidation.

Task breakdown

• Flag store + server/client evaluation + targeting.
• Admin toggle UI + audit.
• Safe-default fallback.
• Tests: on/off/targeted/percentage/fallback.

Acceptance criteria

• Toggling a flag changes behavior without redeploy; risky flags default off when the store is unavailable.

Testing & verification

• Tests for on/off/targeted/percentage + store-outage fallback.

Out of scope

• Full experimentation stats (NEW-101).

Dependencies / related

• Enables safe rollout of ZK/payouts/token; pairs with NEW-101.

Difficulty: medium · Effort: M · dx