Merge wave D — the shared provider is offered only when it is known to work

The done screen's assistant panel stops claiming that the instance's
provider already serves the person. A tri-state read over the operator's
own provider ledger decides between a one-tap offer that mints the
consent receipt, a plain "not answering right now" note, and today's
setup link; anything unknown, any read error, a managed profile and an
operator who has switched the assistant off all fall to no offer.

# Conflicts:
#	e2e/setup/global-setup.ts

docs/api/openapi.yaml

@@ -44485,6 +44485,30 @@ components:
             - type: "null"
           description: v1.22 (#89) — per-user response timeout for AI generation, in seconds (10–600). Null = the built-in
             comprehensive-briefing default (~120 s). Mainly for slow local/self-hosted backends.
+        serverProviderHealth:
+          type: string
+          enum:
+            - healthy
+            - unhealthy
+            - unknown
+          description: "Instance-wide health of the operator's shared providers (`admin-openai` / `admin-codex`), folded across
+            all accounts and reduced to a tri-state: `healthy` when one of them demonstrably served somebody within the
+            last 24 h and no credential sits in its auth-failure cooldown, `unhealthy` when they have been tried and are
+            not working, `unknown` when nothing has been tried yet on this instance or the read failed. Deliberately
+            carries no count, no timestamp and no account identity — 'the provider of this instance last worked' is a
+            statement about the instance, not about other people. Fails closed: treat `unknown` exactly like
+            `unhealthy`. Reading this never probes a provider."
+        serverProviderOffer:
+          type: boolean
+          description: "Whether the shared provider may honestly be offered to this caller in one tap. True only when all of: the
+            operator's provider is the one that would serve them (`managedBy: \"server\"`), `serverProviderHealth` is
+            `healthy`, the operator's assistant master + coach flags are on, the acting record holds its own credentials
+            (a managed profile never does), and the caller holds no receipt yet. Anything unknown makes it false."
+        serverProviderConsent:
+          type: boolean
+          description: Whether this caller already holds an active `ai_full` / `ai_coach` receipt — the grant `POST
+            /api/consent/ai/web` mints. When true there is nothing left to offer, and `serverProviderOffer` is false for
+            that reason rather than for a bad one.
       required:
         - provider
         - model
@@ -44500,6 +44524,9 @@ components:
         - compatModel
         - hasCompatKey
         - responseTimeoutSeconds
+        - serverProviderHealth
+        - serverProviderOffer
+        - serverProviderConsent
       additionalProperties: false
       description: The calling user's AI-provider configuration plus the effective availability (`aiAvailable` + `managedBy`).
         Reports key presence + a masked preview only — never a plaintext key.