middleware: exempt subscription turns from spend caps without requiring UsageBypassEnabled

[Adityakk9031]

Summary

Aligns WithOrgMonthlySpendCap and WithAPIKeySpendCap with WithBalanceCheck so that subscription-covered requests (which debit $0) are exempt from spend limits without requiring UsageBypassEnabled.

Problem

In WithBalanceCheck, any request presenting a valid covering credential (e.g. X-Weave-Anthropic-Subscription or X-Weave-OpenAI-Subscription) passes through flagged subscription-only because subscription turns debit $0 on the caller's own plan.
However, WithOrgMonthlySpendCap and WithAPIKeySpendCap erroneously required installation.UsageBypassEnabled && .... This caused organizations or keys with valid subscription credentials (but without the usage-bypass toggle active) to be rejected with HTTP 402 once their monthly or key limit was reached, even though the turn is free and incurs no platform cost.

Changes

• Updated WithOrgMonthlySpendCap and WithAPIKeySpendCap to check proxy.RequestPresentsCoveringSubscription(...) directly, mirroring WithBalanceCheck.
• Updated unit tests in org_monthly_spend_cap_test.go and api_key_spend_cap_test.go to assert that covered requests pass through as subscription-only regardless of whether UsageBypassEnabled is enabled.

[greptile-apps]

PR author is not in the allowed authors list.

[Adityakk9031]

@aminsamir45 have a look

[devin-ai-integration]

This conforms to our conventions — nothing to change, thanks!

Reviewed against root AGENTS.md and the surrounding middleware patterns. The change lands in the right place and, more importantly, it makes both spend caps agree with WithBalanceCheck, which already documents the rule you're applying: the exemption depends only on whether the request presents a covering subscription, not on UsageBypassEnabled (routing config, not billing config). Both call sites keep flagging the turn billing.WithSubscriptionOnly so the proxy can't fail over to a paid model, so paid spend stays bounded at the cap. The comment edits shrink rather than grow, and the renamed tests assert the new behavior end to end (402 → 200 plus the subscription-only flag), so they'd break if the gate came back — no tautologies. go build ./..., go test ./internal/server/middleware/... and gofmt are all clean locally.