docs: feature-flag usage guide + cross-links

New docs/FEATURE-FLAGS.md captures when to add a flag, where the moving
parts live, how to use useFeatureFlag from app code, the 4 states + 4
scope axes, kill-switch flow, naming conventions, and the parts we know
aren't built yet (partnerSlug eval context, user-level flags, audit-log
integration, server-side cache).

CLAUDE.md gets a one-line convention entry under "Code conventions" so
future devs notice it when grepping for code rules. NEXT-STEPS.md is
updated: the feature-flag backend follow-up is now ticked done with a
pointer to FEATURE-FLAGS.md for the remaining sub-tasks, and the
"What landed" section reflects the real Infrastructure + Flags pages
and the notification drawer.

docs/NEXT-STEPS.md

@@ -152,11 +152,18 @@ What landed:
 - Audience-aware JwtAuthGuard accepts both `dezky-portal` and `dezky-operator`
 - `Partner` schema + CRUD endpoints, `Tenant.partnerId` ref
 - Tenant lifecycle (suspend / resume) gated by OperatorGuard
+- **Real Infrastructure live-probes** — `GET /health/platform` runs TCP +
+  HTTP probes against every neighbouring service; UI splits "Live" vs
+  "Planned" with honest status.
+- **Real feature-flag system** — `Flag` schema + CRUD + bulk eval +
+  operator UI + `useFeatureFlag` composable in the portal. Hash-based
+  deterministic rollout. See [`FEATURE-FLAGS.md`](./FEATURE-FLAGS.md).
 - Operator UI: Overview (real KPIs), Tenants (7-tab detail w/ Danger),
-  Partners (attach/detach), Users, Operator team. Visual-only Infrastructure,
-  Feature flags, Audit. Placeholders for Support/Billing/Reports/Settings.
+  Partners (attach/detach), Users, Operator team, real Infrastructure,
+  real Feature flags. Visual-only Audit. Placeholders for
+  Support/Billing/Reports/Settings.
 - Interactions: ⌘K command palette, impersonation stub (modal + banner),
-  incident modal, tweaks panel (theme/density/env)
+  incident modal, tweaks panel, **notification drawer**.
 
 ### Follow-ups before operator hits production
 
@@ -168,8 +175,10 @@ In rough priority order — bulk lifted from OPERATOR-PLAN.md:
 - [ ] **Real audit log collection** — `platform_audit` Mongo collection,
       written by platform-api on every privileged action; stream from there
       instead of `data/fixtures.ts`
-- [ ] **Feature flag backend** — `Flag` schema + per-tenant rollout state
-      + a tiny flag-eval client every service imports
+- [x] **Feature flag backend** — shipped. See
+      [`FEATURE-FLAGS.md`](./FEATURE-FLAGS.md). Remaining sub-tasks:
+      partnerSlug eval context, user-level flags, audit-log integration,
+      server-side cache (all called out in that doc).
 - [ ] **Incident management backend** — `Incident` schema + paging
       (PagerDuty / OpsGenie / custom). Until then, IncidentModal is mock.
 - [ ] **Support ticket queue** — `SupportTicket` schema + email-in