feat(billing-v2-c): ProjectController preflight — 409 при перегрузке баланса

Task 1.7 плана 2026-05-24-billing-v2-spec-c-preflight-vtb.

store/update проверяют преfflight перед созданием/изменением проекта:
- если сумма daily_limit_target всех активных не-blocked проектов
  превышает capacity баланса (через BalancePreflightService) и не
  передан force_save_blocked=true → возврат 409 с JSON-телом:
  {error, current_balance_rub, current_capacity_leads,
   would_be_required_leads, deficit_leads}
- если force_save_blocked=true → проект создаётся/обновляется с
  preflight_blocked_at=now() (точечная заморозка одного проекта,
  не блокирует остальные).

Safe fallback: без активных pricing_tiers — преfflight skipped
(legacy-окружения без настроенного биллинга).

TDD: 4 теста GREEN (409 store / 409 update / force_save_blocked
создаёт blocked / norm pass через capacity).

Регрессия: 0 регрессий на Plan5 ProjectsStoreTest+ProjectsUpdateTest
(37/37 GREEN после safe fallback).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/app/Http/Controllers/Api/ProjectController.php

@@ -10,7 +10,10 @@ use App\Http\Requests\StoreProjectRequest;
 use App\Http\Requests\UpdateProjectRequest;
 use App\Http\Resources\ProjectResource;
 use App\Jobs\SyncSupplierProjectJob;
+use App\Models\PricingTier;
 use App\Models\Project;
+use App\Models\Tenant;
+use App\Services\Billing\BalancePreflightService;
 use App\Services\Project\ProjectService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -117,7 +120,35 @@ class ProjectController extends Controller
     /** POST /api/projects */
     public function store(StoreProjectRequest $request): JsonResponse
     {
-        $project = $this->projects->create($request->user()->tenant, $request->validated());
+        $validated = $request->validated();
+        $tenant = $request->user()->tenant;
+        $forceSaveBlocked = (bool) ($validated['force_save_blocked'] ?? false);
+        unset($validated['force_save_blocked']);
+
+        // Spec C §3.4: преfflight баланса при создании. existingLimit учитывает только активные.
+        $existingLimit = (int) Project::where('tenant_id', $tenant->id)
+            ->where('is_active', true)
+            ->whereNull('preflight_blocked_at')
+            ->sum('daily_limit_target');
+        $wouldBeRequired = $existingLimit + (int) $validated['daily_limit_target'];
+
+        $preflight = $this->runPreflight($tenant, $wouldBeRequired);
+
+        if (! $preflight['passes'] && ! $forceSaveBlocked) {
+            return response()->json([
+                'error' => 'balance_insufficient',
+                'current_balance_rub' => (string) $tenant->balance_rub,
+                'current_capacity_leads' => $preflight['capacity_leads'],
+                'would_be_required_leads' => $wouldBeRequired,
+                'deficit_leads' => $preflight['deficit_leads'],
+            ], 409);
+        }
+
+        if (! $preflight['passes'] && $forceSaveBlocked) {
+            $validated['preflight_blocked_at'] = now();
+        }
+
+        $project = $this->projects->create($tenant, $validated);
 
         return response()->json(['data' => new ProjectResource($project)], 201);
     }
@@ -126,11 +157,70 @@ class ProjectController extends Controller
     public function update(UpdateProjectRequest $request, int $id): JsonResponse
     {
         $project = Project::where('tenant_id', $request->user()->tenant_id)->findOrFail($id);
-        $updated = $this->projects->update($project, $request->validated());
+        $validated = $request->validated();
+        $tenant = $request->user()->tenant;
+        $forceSaveBlocked = (bool) ($validated['force_save_blocked'] ?? false);
+        unset($validated['force_save_blocked']);
+
+        // Spec C §3.4: преfflight при изменении лимита — учитываем новое значение для ЭТОГО
+        // проекта + лимиты остальных активных не-blocked.
+        if (array_key_exists('daily_limit_target', $validated)) {
+            $existingLimit = (int) Project::where('tenant_id', $tenant->id)
+                ->where('id', '!=', $project->id)
+                ->where('is_active', true)
+                ->whereNull('preflight_blocked_at')
+                ->sum('daily_limit_target');
+            $wouldBeRequired = $existingLimit + (int) $validated['daily_limit_target'];
+
+            $preflight = $this->runPreflight($tenant, $wouldBeRequired);
+
+            if (! $preflight['passes'] && ! $forceSaveBlocked) {
+                return response()->json([
+                    'error' => 'balance_insufficient',
+                    'current_balance_rub' => (string) $tenant->balance_rub,
+                    'current_capacity_leads' => $preflight['capacity_leads'],
+                    'would_be_required_leads' => $wouldBeRequired,
+                    'deficit_leads' => $preflight['deficit_leads'],
+                ], 409);
+            }
+
+            if (! $preflight['passes'] && $forceSaveBlocked) {
+                $validated['preflight_blocked_at'] = now();
+            }
+        }
+
+        $updated = $this->projects->update($project, $validated);
 
         return response()->json(['data' => new ProjectResource($updated)]);
     }
 
+    /**
+     * @return array{passes: bool, capacity_leads: int, deficit_leads: int}
+     */
+    private function runPreflight(Tenant $tenant, int $requiredLeads): array
+    {
+        $tiers = PricingTier::query()->where('is_active', true)->get();
+
+        // Safe fallback: без активных pricing_tiers биллинг не настроен —
+        // преfflight не имеет смысла, пропускаем (legacy-окружения / тесты).
+        if ($tiers->isEmpty()) {
+            return ['passes' => true, 'capacity_leads' => PHP_INT_MAX, 'deficit_leads' => 0];
+        }
+
+        $result = (new BalancePreflightService)->evaluate(
+            balanceRub: (string) $tenant->balance_rub,
+            deliveredInMonth: (int) $tenant->delivered_in_month,
+            requiredLeads: $requiredLeads,
+            tiers: $tiers,
+        );
+
+        return [
+            'passes' => $result->passes,
+            'capacity_leads' => $result->capacityLeads,
+            'deficit_leads' => $result->deficitLeads,
+        ];
+    }
+
     /** GET /api/projects/{id} */
     public function show(Request $request, int $id): JsonResponse
     {