fix(vision-manager): retain analysis-enabled gate alongside memory-yield

The analysis-disabled gate (stop/inhibit vision when Admin→Settings analysis
is OFF, so stale queued jobs don't pin ~4.4GiB) was applied directly on the
host and never committed, so it was absent from main and from this branch —
merging as-is would have regressed it. Re-introduce it here so the merged
manager has BOTH gates: vision is held down if analysis is disabled OR host
memory is tight. Also grant the read-only role SELECT on app_settings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vision-manager/readonly-role.sql

@@ -26,7 +26,11 @@ SELECT 'CREATE ROLE vision_manager LOGIN'
 -- (Re)set the password every run so rotating it is just a re-apply.
 ALTER ROLE vision_manager LOGIN PASSWORD :'pw';
 
--- CONNECT to the current database, and read-only on the one table we poll.
+-- CONNECT to the current database, and read-only on the two tables we poll:
+-- crawler_jobs (backlog depth + crawl-in-flight) and app_settings (the runtime
+-- analysis-enabled flag — without this the manager can't tell that analysis was
+-- turned off and would keep vision pinned on stale queued jobs).
 GRANT CONNECT ON DATABASE :"DBNAME" TO vision_manager;
 GRANT USAGE ON SCHEMA public TO vision_manager;
 GRANT SELECT ON crawler_jobs TO vision_manager;
+GRANT SELECT ON app_settings TO vision_manager;