docs: define SaaS capacity controls

docs/adr/0021-org-admin-project-onboarding.md

@@ -11,8 +11,8 @@ surface is not only the Feishu bot trigger path, but also the control planes
 around it:
 
 - platform staff need a private platform admin area to create and operate orgs;
-- customer org owners/admins need an org admin area for teams, roles, model
-  provider configuration, projects, folders, sessions, and usage accounting;
+- customer org owners/admins need an org admin area for teams, roles, provider
+  mode and BYOK configuration, projects, folders, sessions, and usage accounting;
 - ordinary teachers should be able to start work from the natural Feishu group
   flow without entering the web backend.
 
@@ -46,6 +46,19 @@ OAuth login, bot messages, and directory sync. App secrets are org-scoped
 secrets and must be encrypted at rest; business code should access them through
 a secret/connection resolver, not raw plaintext columns.
 
+Each Organization chooses one model-provider credential mode:
+
+- `BYOK`: an Organization OWNER/ADMIN supplies and manages that Organization's
+  provider key and base URL in the org admin area;
+- `PLATFORM_MANAGED`: a platform admin supplies and manages one distinct key
+  and base URL for that Organization in the platform admin area. Organization
+  users cannot read the plaintext credential.
+
+Provider connections remain Organization-scoped in both modes. Unrelated
+Organizations never share a process-global provider key. Provider secrets must
+be encrypted at rest and resolved at runtime through the same connection/secret
+boundary as Feishu credentials.
+
 Project management has two creation paths:
 
 - org owner/admin creates projects in the org web backend;
@@ -77,9 +90,10 @@ aggregation:
 Project permissions remain on `PROJECT` resources. Moving a project between
 folders does not change grants.
 
-Usage accounting is org-wise and project/folder aggregatable. It is not payment
-collection in the pilot because customers supply their own model provider API
-keys and base URLs.
+Usage accounting is org-wise and project/folder aggregatable for both provider
+modes. It is not payment collection in the pilot: BYOK spend belongs to the
+customer's provider account, while platform-managed spend is attributed to the
+Organization for operational reporting; commercial billing remains deferred.
 
 ## Consequences
 
@@ -89,8 +103,8 @@ keys and base URLs.
   explorer without creating a second ACL system.
 - Service code should expose project creation and chat binding as reusable
   backend operations so Feishu cards and future web APIs call the same rules.
-- Org role/model/provider/billing panels can be added on top of the org tenant
-  root without changing project authorization.
+- Org role/model/provider-mode panels and the platform-managed connection panel
+  can be added on top of the org tenant root without changing project authorization.
 
 ## Open Questions / Deferred