fix(kiloclaw): block retrial after destroyed instance

[jeanduplessis]

Summary

Counts destroyed personal KiloClaw instances as prior trial history when reporting billing status.

Why this change is needed

Users who destroyed a personal instance could still see trialEligible=true because billing status only looked at non-destroyed personal instances. That drifted from intended first-trial-only rule and from ensureProvisionAccess, which already blocks new trials once any prior personal history or subscription exists.

How this is addressed

• Changed billing-status trial eligibility check to look at any personal instance row, not only active non-destroyed rows.
• Updated router regression coverage so a user with only a destroyed personal instance now gets trialEligible=false.

Verification

• pnpm test -- apps/web/src/routers/kiloclaw-billing-router.test.ts
• pnpm typecheck
• pnpm format

Visual Changes

N/A

Reviewer Notes

Human Reviewer

• Stacked on docs(specs): clarify kiloclaw compliance rules #2578.
• Assumes destroyed personal instance history should count same as other prior personal KiloClaw history for first-trial eligibility. This matches spec-compliance plan and keeps getBillingStatus aligned with provision-time gating.

Code Reviewer Agent

Code Reviewer Notes

• getPersonalBillingStatus previously queried kiloclaw_instances with destroyed_at IS NULL when deriving trialEligible. This PR removes that filter for personal rows only; organization rows remain excluded.
• No change to access-state, subscription selection, or trial bootstrap paths. Scope limited to billing-status response and regression test expectations.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/routers/kiloclaw-router.ts
• apps/web/src/routers/kiloclaw-billing-router.test.ts

---

_{Reviewed by gpt-5.4-2026-03-05 · 385,127 tokens}