Feature flag enforced at the API/route boundary but not the service it guards — background jobs bypass it (fail-open via the side door)