Add limited Freebuff DeepSeek access

[brandonkachen]

Summary

Adds a limited Freebuff access tier for users outside the approved-country path, including VPN/unknown-location classifications. Limited users are routed to DeepSeek V4 Flash, see only that model in the selector, and are capped at five one-hour limited sessions per Pacific day.

What changed

• Classify Freebuff country/privacy results into full or limited access instead of hard-blocking unsupported locations.
• Add shared Freebuff access-tier model helpers and wire accessTier through session responses.
• Store access_tier on free_session and free_session_admit with a generated migration.
• Enforce limited-mode model/session gating in session admission and chat completions.
• Update the CLI model picker, waiting room quota text, and ended-session banner for limited access.
• Merge latest origin/main and preserve its premium reset countdown and analytics/logging updates.

Validation

• bun test common/src/__tests__/freebuff-models.test.ts web/src/server/free-session/__tests__/public-api.test.ts web/src/app/api/v1/freebuff/session/__tests__/session.test.ts web/src/app/api/v1/chat/completions/__tests__/completions.test.ts cli/src/utils/__tests__/freebuff-premium-reset.test.ts common/src/util/__tests__/analytics-sampling.test.ts
• bun run --cwd common typecheck
• bun run --cwd cli typecheck
• bun run --cwd web typecheck
• bun run --cwd packages/internal typecheck
• git diff --check

Note: the chat completions test path still prints the existing Postgres reconnect TimeoutNegativeWarning, but the tests pass.

[ankit-realfast]

thanks @jahooma for this