[BIGSMKE12]

Summary

Consolidated PR for every remaining BigSMKE12 task in this repository: #395, #411, #463, #484.

• Phase 9: Plugin lockfile migration #395 — add the missing plugin_lock_entries migration and repair the duplicate Alembic revision/multiple heads.
• Phase 9: Development-only plugin hot reload #411 — development-only plugin hot reload with a production guard.
• Phase 10: Pre-call budget check that fails closed #463 — record refused budget calls in the usage ledger with status=denied and a source derived from the endpoint.
• Phase 10: Cost center and project tagging #484 — cost-center tags on usage records, dashboard rollups, and CSV exports.

Validation

• pytest tests/test_plugin_hot_reload.py tests/test_usage_cost_center.py tests/test_budget_refusal_ledger.py -q — PASS (4 passed)
• Targeted ruff and black --check on changed Python files — PASS
• Alembic graph — single head f0e1d2c3b4a5
• The Flask migration harness timed out locally; graph-head and migration definitions are included.
• Repo-wide ruff/black remain blocked by the pre-existing invoice_export.py breakage from feat(billing): export invoices as CSV and PDF with size bounds (#483) #535.

Issue

Closes #395
Closes #411
Closes #463
Closes #484