perf(auth): read the operator settings once per request

An app boot's /api/auth/me read the AppSettings singleton six times, each
reader with its own few columns: the MFA policy, the Assistant switches,
the module availability, the provider presence, the AI usage bounds and
the reasoning controls. They now take their columns from one read,
memoised for the request and read afresh inside a background job like the
readers themselves. No answer changes.

src/lib/feature-flags/index.ts

@@ -1,4 +1,4 @@
-import { prisma } from "@/lib/db";
+import { readOperatorRow } from "@/lib/settings/operator-row";
 import { getEvent } from "@/lib/logging/context";
 import { memoizePerRequest } from "@/lib/request-cache";
 
@@ -57,16 +57,7 @@ export function loadAssistantSwitches(): Promise<AssistantFlagSet | null> {
     "assistant-flags",
     async () => {
       try {
-        const settings = await prisma.appSettings.findUnique({
-          where: { id: "singleton" },
-          select: {
-            assistantEnabled: true,
-            assistantCoachEnabled: true,
-            assistantBriefingEnabled: true,
-            assistantInsightStatusEnabled: true,
-            assistantDocumentAiEnabled: true,
-          },
-        });
+        const settings = await readOperatorRow();
         return resolveAssistantFlags({
           enabled: settings?.assistantEnabled ?? true,
           coach: settings?.assistantCoachEnabled ?? true,