Atomic credit debit + ledger append

Called by the agent app's chat route in a fire-and-forget after() tail task once a chat turn's stream completes.

Idempotency: replays of the same chat_request_id return { status: "duplicate", credit_cost, balance_after } without debiting again — the unique partial index on credit_transaction.chat_request_id is the source of truth.

Free-tier callers (no credit_balance row) get { status: "no_balance", ... } instead of an error — the agent's free-tier message-count gate handles those users via a different path.