release: 2.0.58 — drought mode hard-blocks premium models with 503

v2.0.57 only exposed drought state to dashboard / health. This version
upgrades it to a hard gate: when every active account has weekly% < 5
AND droughtRestrictPremium=true (default ON), premium model requests
return 503 + Retry-After + error.type='drought_mode' + structured
allowedModels list. Free-tier models (gemini-2.5-flash + dynamically
discovered) still route normally so the proxy stops burning the last
few percent of quota on upstream 429s.

Three independent off-switches:
- env DROUGHT_RESTRICT_PREMIUM=0 (highest priority)
- runtime-config experimental.droughtRestrictPremium=false (dashboard toggle)
- account pool not actually in drought (any healthy account in the pool)

Changes:
- auth.js: new helpers isModelBlockedByDrought / isDroughtRestrictEnabled
  / setDroughtRestrictResolver. getDroughtSummary now returns
  restrictEnabled + freeTierModels.
- handlers/chat.js: gate placed between deprecated check (410) and
  model-access (403) so it sits at the right priority level.
- runtime-config.js: experimental.droughtRestrictPremium=true default,
  wired through setDroughtRestrictResolver hook.
- Dashboard UI: toggle on default + sketch experimental panel, i18n zh/en.
- 10 new regression tests cover env/runtime priority, free-tier passthrough,
  off-switch and edge cases (null modelKey, restrict disabled, healthy pool).

Tests: 629 → 639 (+10).