docs: feature-flag usage guide + cross-links

New docs/FEATURE-FLAGS.md captures when to add a flag, where the moving
parts live, how to use useFeatureFlag from app code, the 4 states + 4
scope axes, kill-switch flow, naming conventions, and the parts we know
aren't built yet (partnerSlug eval context, user-level flags, audit-log
integration, server-side cache).

CLAUDE.md gets a one-line convention entry under "Code conventions" so
future devs notice it when grepping for code rules. NEXT-STEPS.md is
updated: the feature-flag backend follow-up is now ticked done with a
pointer to FEATURE-FLAGS.md for the remaining sub-tasks, and the
"What landed" section reflects the real Infrastructure + Flags pages
and the notification drawer.

CLAUDE.md

@@ -201,6 +201,11 @@ These choices were made deliberately after extensive license/architecture resear
 - **Prefer prose comments** over heavy JSDoc — explain *why*, not *what*
 - **MongoDB** for portal app data (consistent with Målerportal, TurtleLootLine)
 - **PostgreSQL** for services that require it (Authentik, OCIS)
+- **Feature flags ship through `useFeatureFlag('key')`**, NOT hardcoded
+  `if (env === ...)` checks. Risky / plan-gated / kill-switchable features
+  go behind a flag. See [`docs/FEATURE-FLAGS.md`](./docs/FEATURE-FLAGS.md)
+  for when to add one, how to use the composable, and the 4 states / 4 scope
+  axes.
 
 ### Production target (for reference, not deploy now)