Make Auto flagger configurable

[16francej]

Summary

• add an org-level Auto flagger harness, model, and rubric setting
• keep the untrusted-data boundary and verdict contract platform-owned
• route model screening through the configured harness without changing proxy shadow/enforce behavior
• add governance controls with reset-to-default support

Testing

• npm run typecheck
• npm run format:check
• npm run lint
• npm run lint:knip
• npm run lint:ox
• focused Auto flagger persistence, routing, classifier, and admin API tests
• npm test --prefix plugins/admin (80 passed)
• broad root suite (4,055 passed, 159 skipped; the host-injected-token scratch fixture passed when rerun without host capability variables)
• live core/admin save and read-back round trip

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}