Add complimentary OOBE polish and configurable admin mTLS

Allow one server-audited onboarding polish request without credits and make the certificate gate temporarily reversible while preserving application authentication.

docs/openapi.yaml

@@ -410,6 +410,9 @@ paths:
         and output-budget policy from `capability` plus optional `taskKind`. It
         never infers task type from `input` or `context`, and clients cannot
         supply provider parameters. Search and tools are currently disabled.
+        An authenticated `oobe` purpose is accepted only for dictation polish.
+        The first successful request per account is complimentary; later attempts
+        fail without falling through to paid billing.
       parameters:
         - $ref: "#/components/parameters/RequestId"
         - name: capability
@@ -529,7 +532,7 @@ paths:
           content:
             application/json:
               schema: { $ref: "#/components/schemas/AdminSessionState" }
-        "404": { description: Verified administrator client certificate is absent }
+        "404": { description: Verified administrator client certificate is absent while mTLS is required }
   /v1/admin/auth/login:
     post:
       security:
@@ -887,7 +890,7 @@ components:
       bearerFormat: JWT
     adminMtls:
       type: mutualTLS
-      description: Client certificate issued by the dedicated administrator CA.
+      description: Client certificate issued by the dedicated administrator CA; required when ADMIN_MTLS_REQUIRED is true.
     adminSession:
       type: apiKey
       in: cookie
@@ -1714,6 +1717,12 @@ components:
           type: ["string", "null"]
           enum: [hotword, null]
           description: Optional product entry point; hotword is accepted only for AI requests
+        requestPurpose:
+          type: ["string", "null"]
+          enum: [oobe, null]
+          description: |
+            Optional server-audited billing purpose. `oobe` is valid only with
+            `polish` and `dictation_polish`, and is complimentary once per account.
     CreateGatewayGrantRequest:
       type: object
       additionalProperties: false