Feature flags

Kill switches for platform features. Each is on by default; turning one off takes effect within 30 seconds in every API and worker process. Changes are recorded in the audit log.