Claim a run - THE spend gate

Clerk-session only. The one route that can authorize spending: everything paid downstream demands a runId this issued to the caller. By the time it returns the member has ALREADY been charged (generationsUsed is incremented before the runId exists), so a crash mid-run costs the member their allowance rather than the card. The claim is atomic single-winner, so two tabs still produce exactly one run. The agent-token path is the MCP tool ic_funko_generate_start (scope funko:write), which spends through the same claim, then ic_funko_generate_step / ic_funko_generate_status drive the run server-side.