Budget hold: no downloads while Gemini refuses for budget reasons, one probe per cycle, automatic resume; adoption capped; target default

Cost: bounded Gemini thinking on every call (default low), figure mining off by default; one-shot config migration

Never store a credential: redact at every DB write and at boot; keep PDFs when Gemini refuses for budget reasons

Merge the 17 Sep "more papers" lanes onto the hotfix line; parallel ingestion; throughput knobs