feat(cutover): Faza C feature-flag infra for api.gis.ac

Server-side helper useGisAcFlag(email) → boolean, gated by:
- USE_GIS_AC=1 (global rollout switch), OR
- GIS_AC_PILOT_USERS=a@x,b@y (per-email staged rollout)

Both defaults are off (USE_GIS_AC=0, pilot list empty) in Infisical
/architools — this PR is dormant; no call sites consume the flag yet.
Future Faza D/E call sites in src/lib/gis-api-client.ts and
src/modules/geoportal/* will branch on it.

Exposed on session.useGisAc so client components can branch identically
to server routes without a separate API roundtrip. Re-evaluated per
request → flag flip via Infisical + container restart, no rebuild.

Per-user override (PILOT_USERS) is the rollout vehicle:
1. Deploy with flag=0 (default) → nothing changes
2. Set GIS_AC_PILOT_USERS=marius@... → Marius sees new code path
3. Watch 24-48h → set USE_GIS_AC=1 → global cutover
4. Rollback = unset USE_GIS_AC

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/core/auth/auth-options.ts

@@ -1,5 +1,6 @@
 import type { NextAuthOptions } from "next-auth";
 import AuthentikProvider from "next-auth/providers/authentik";
+import { useGisAcFlag } from "@/core/feature-flags/use-gis-ac";
 
 export const authOptions: NextAuthOptions = {
   providers: [
@@ -55,6 +56,10 @@ export const authOptions: NextAuthOptions = {
         (session.user as any).company = token.company || "group";
       }
       (session as any).accessToken = token.accessToken;
+      // Faza C cutover flag — exposed on session so client components can
+      // branch the same way server routes do (env-driven, evaluated per
+      // request so flag flip + container restart picks up without rebuild).
+      (session as any).useGisAc = useGisAcFlag(session.user?.email);
       return session;
     },
   },