Cost: bounded Gemini thinking on every call (default low), figure mining off by default; one-shot config migration

Never store a credential: redact at every DB write and at boot; keep PDFs when Gemini refuses for budget reasons