Preview environments, TTL-swept and secret-scrubbed

Preview environments are now end to end and included in paid plans.

• Create a preview from production in under three minutes with zero cloned secrets.
• TTL expiry runs unattended in the operator's reconcile loop, so forgotten branches are swept automatically.
• data_mode and ttl are first-class on POST /v1/…/environments; extend with POST /v1/…/environments/{id}/renew.
• Usage envelope and caps are readable at GET /v1/…/environments/{id}/usage.