Let one gate decide every AI surface, so switching AI off actually removes all of it

The Tools card adopted the AI scripts on the host check alone, and api/ai.php only
tested AI_ENABLED in front of ask, so a disabled subsystem still had rows to run and
an endpoint that answered.

Plugin/unraid/api/ai.php

@@ -134,6 +134,16 @@ if (!vv_is_ai_host()) {
     exit;
 }
 
+// Master switch, on the same footing as the host gate rather than only in front of ask. With
+// AI_ENABLED false the tab is not in the tab list and the scheduler dock is not rendered, so
+// nothing in the UI can legitimately reach any action here — including the cheap reads, which
+// would otherwise still answer with index and token figures for a subsystem the operator has
+// turned off. Not a 404: the switch is a setting, and the message names the setting.
+if (!vv_ai_enabled()) {
+    echo json_encode(['ok' => false, 'error' => 'AI_ENABLED is false — AI features are off']);
+    exit;
+}
+
 // ── stats ─────────────────────────────────────────────────────────────────────
 if ($action === 'stats') {
     echo json_encode(['ok' => true, 'stats' => vv_ai_stats()]);
@@ -220,10 +230,6 @@ if ($action === 'incident_add') {
 if ($action === 'ask') {
     if (!$isPost) { http_response_code(405); echo json_encode(['ok' => false, 'error' => 'POST only']); exit; }
 
-    if (!vv_ai_enabled()) {
-        echo json_encode(['ok' => false, 'error' => 'AI_ENABLED is false — AI features are off']); exit;
-    }
-
     $cfg = vv_ai_config();
     if ($cfg['model'] === '') {
         echo json_encode(['ok' => false, 'error' => 'No generation model configured']); exit;