fix(admin): preserve hierarchy enabled_at on flip-off; add disabled_at for forensics

[bokelley]

Refs #3466. Delivers acceptance criteria items 2–4 only. Item 1 (IP + user-agent in audit details) is deferred — see triage comment on #3466 for the compliance decision needed first.

Summary

Migration 450 nulled auto_provision_hierarchy_enabled_at when auto_provision_brand_hierarchy_children was flipped off, silently destroying the forensic record of when the feature was last active. This PR:

• Adds auto_provision_hierarchy_disabled_at TIMESTAMPTZ NULL to organizations (migration 452)
• Updates the track_auto_provision_hierarchy_enabled_at trigger so flip-off sets disabled_at = NOW() and preserves enabled_at (which the cohort gate in autoLinkByVerifiedDomain reads exclusively — gate semantics unchanged)
• Adds the field to the Organization TS interface
• Updates both integration test suites (org-auto-provision-toggles, find-paying-org-for-domain) to match the new semantics and adds an enable → disable → re-enable cycle test

A complete (enabled_at, disabled_at) pair lets incident response trace the full on/off cycle without losing the original opt-in timestamp.

Non-breaking justification

Adds a single nullable column with no DEFAULT; existing rows get NULL (no table rewrite). No read path or gate logic changed. The Organization interface addition is additive.

Pre-PR review

• code-reviewer: approved — trigger replacement via CREATE OR REPLACE FUNCTION is correct (PostgreSQL binds triggers by function name); test cycle assertions are sound; no flakiness risk. Nit: add trigger name to migration comment (not blocking).
• internal-tools-strategist: approved — disabled_at correctly DB-only (not surfaced in GET /domains API); ADD COLUMN IF NOT EXISTS on nullable column is metadata-only in PG 11+, no lock concern. Identified blocker (stale assertion in find-paying-org-for-domain.test.ts) — fixed in this commit.

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See #3121
for context.

Session: https://claude.ai/code/session_01Pn9rJFGQxPJpKGfUyF6W2v

---

Generated by Claude Code