Ambassador program — production deploy readiness (deploy HELD)

UPDATE (commit fde3808, held main): the ambassador master KILL-SWITCH shipped. The whole program now ships OFF — config('vodmanager.referrals.enabled') defaults to env REFERRALS_ENABLED=false; App\Support\Referrals\ReferralProgram::enabled() gates attribution, the qualification listener, the public routes (/{code} + overlays → 404), the ambassador dashboard/referrals components, the invitation-acceptance gate + dashboard callout, and the sidebar nav item. Admin tooling (/admin/ambassadors, /admin/settings/referrals) stays reachable so you can prep + flip it on live via AppSettings (no redeploy). CONSEQUENCE: ambassador is no longer a deploy blocker. The code can merge + deploy fully but hidden, so the prod free-storage bucket + reward-email decision only matter the day you turn the program on. This deploy readiness now effectively depends only on the clip track (#151) being prod-safe, not on the ambassador refinement (#150) / comms (#147) — those remain gating for the LATER ambassador launch, not for shipping the clip work.

The ambassador referral program is merged to local `main` (through commit d8d07f5) but intentionally NOT pushed — `origin/main` is 7 behind and deploy is held. This brief tracks getting it safely to production. Full detail: HANDOFF.md. Pre-deploy checklist (clear before pushing/deploying): 1. Prod free storage must be real — `FREE_STORAGE_*` env + B2 bucket created + `FREE_STORAGE_ENABLED=true`. Ambassador storage uses `StorageProfile::freeTier()`; without it ambassadors can't be assigned storage. **Likely the main blocker.** 2. Reward-emails decision — senders are NOT wired (Solo todo #576); templates are built and previewable locally at `/dev/mail`. Decide: launch without them (dashboard + overlays fully work) or build #576 first. 3. Run 5 additive/expand-only migrations (add_referral_bonus_fields_to_users, create_referral_codes, create_referrals, create_ambassador_invitations, add_history_columns_to_referral_codes). 4. Grant the first ambassadors via `/admin/ambassadors` (invitations) or `/admin/users/{user}` (tier). Invite-only by design. 5. (Recommended before scaling) admin cost dashboard (Solo #574) — lower priority given the operator is happy to fund hand-picked friends at this scale. Context: initial audience is a hand-picked group of trusted streamer friends the operator is happy to give large free accounts to; abuse/cost-against-strangers is a non-concern at this stage.