…-level eligibility

Combine five related changes that mirror AppBuilder behavior in Cloud Agent
Next and extract a shared helper for the balance-threshold access level
shape used by three routers.

- Cloud Agent Next: allow users with no balance to create sessions against
  free models. NewSessionPanel hides the blocking banner and filters to
  free / BYOK-capable models when accessLevel is 'limited'; the personal
  and organization prepareSession routers route free or BYOK-capable
  models through the shared AppBuilder client so the worker skips the
  $1 minimum balance check. Paid models continue to require the minimum.
- Introduce apps/web/src/lib/access-level-eligibility.ts with a generic
  buildAccessLevelEligibility helper. cloud-agent-next-eligibility.ts is
  now a thin wrapper that preserves its type aliases and constant;
  app-builder-router.ts and organization-app-builder-router.ts delegate
  to the shared helper with MIN_BALANCE_FOR_APP_BUILDER. No public/tRPC
  type changes.
- Extract server-side eligibility into
  computeCloudAgentNextBalanceCheckEligibility so the routers consult the
  user's enabled BYOK providers (or the org's) alongside isFreeModel,
  closing the gap where a zero-balance user picking a BYOK-capable paid
  model still hit the worker minimum.

Tests cover free / BYOK / paid gating on both routers, the accessLevel
branches, and the new helper.

…gent users

isFormValid still gated submission on !hasInsufficientBalance, which is true
for every accessLevel: 'limited' user. The submit button (and Cmd/Ctrl+Enter
shortcut) stayed disabled even after such a user picked a free or
BYOK-capable model from the already-filtered picker.

Mirror the picker's isFree || hasUserByokAvailable filter in isFormValid so
the UI matches what the server (computeCloudAgentNextBalanceCheckEligibility
+ x-skip-balance-check) already permits. Paid models selected via stale state
or agent override remain blocked.