fix: populate feature_flags.json and remove sys.path bootstrap inserts

- feature_flags.json: populated with 6 well-described flags reflecting
  current system state (DI migration, structlog, CORS enforcement,
  X-Wallet-Address trust, ZK proof, marketplace rate limiting)

- Remove sys.path.insert bootstrap from app main.py files:
  - apps/agent-management/src/app/main.py
  - apps/marketplace-service/src/marketplace_service/main.py
  - apps/wallet/src/app/main.py
  - apps/blockchain-node/src/aitbc_chain/combined_main.py
  PYTHONPATH is set correctly by the wrapper scripts in scripts/wrappers/
  so the inserts are redundant and misleading.

Wrapper scripts (scripts/wrappers/*.py) and lazy cross-app imports in
blockchain-event-bridge are intentionally left unchanged.

apps/agent-management/src/app/main.py

@@ -1,14 +1,6 @@
 #!/usr/bin/env python3
 """AITBC Agent Management Service"""
 
-import sys
-from pathlib import Path
-
-# Add project root to path
-project_root = Path(__file__).parent.parent.parent.parent.parent
-if str(project_root) not in sys.path:
-    sys.path.insert(0, str(project_root))
-
 import uvicorn
 from fastapi import FastAPI
 from aitbc import get_logger

apps/blockchain-node/src/aitbc_chain/combined_main.py

@@ -5,11 +5,6 @@ Runs both the main blockchain node, P2P placeholder service, and HTTP RPC server
 """
 
 import asyncio
-import sys
-from pathlib import Path
-
-# Add src to path
-sys.path.insert(0, str(Path(__file__).parent.parent))
 
 from aitbc import get_logger
 from aitbc_chain.main import BlockchainNode, _run as run_node

apps/marketplace-service/src/marketplace_service/main.py

@@ -3,11 +3,6 @@ Marketplace Service main application
 Manages GPU marketplace operations
 """
 
-import sys
-from pathlib import Path
-# Add aitbc package to Python path
-sys.path.insert(0, str(Path(__file__).parent.parent.parent.parent.parent))
-
 from contextlib import asynccontextmanager
 from typing import AsyncIterator
 

apps/wallet/src/app/main.py

@@ -3,9 +3,6 @@ from __future__ import annotations
 from fastapi import FastAPI
 import uvicorn
 
-import sys
-sys.path.insert(0, "/opt/aitbc")
-
 from aitbc.rate_limiting import RateLimitMiddleware
 
 from .api_jsonrpc import router as jsonrpc_router

feature_flags.json

@@ -1 +1,50 @@
-{}
+{
+  "use_shared_agent_integration_service": {
+    "enabled": false,
+    "description": "Route agent integration calls through the shared aitbc-agent-core service instead of per-app implementations. Enable gradually after migration testing.",
+    "rollout_percentage": 0.0,
+    "whitelisted_users": [],
+    "blacklisted_users": [],
+    "enabled_since": null
+  },
+  "use_structlog": {
+    "enabled": false,
+    "description": "Use structlog-based structured logging instead of per-app logging implementations. Enable after logging standardisation migration.",
+    "rollout_percentage": 0.0,
+    "whitelisted_users": [],
+    "blacklisted_users": [],
+    "enabled_since": null
+  },
+  "strict_cors_enforcement": {
+    "enabled": true,
+    "description": "Enforce strict CORS origin allowlists on all services. Disabling falls back to permissive wildcard (dev only).",
+    "rollout_percentage": 100.0,
+    "whitelisted_users": [],
+    "blacklisted_users": [],
+    "enabled_since": "2026-05-24T00:00:00"
+  },
+  "trust_x_wallet_address_header": {
+    "enabled": false,
+    "description": "Trust the X-Wallet-Address header for authentication without JWT verification. Only for internal trusted networks; requires TRUST_X_WALLET_ADDRESS=true env var as well.",
+    "rollout_percentage": 0.0,
+    "whitelisted_users": [],
+    "blacklisted_users": [],
+    "enabled_since": null
+  },
+  "enable_zk_proof_verification": {
+    "enabled": false,
+    "description": "Enable real zero-knowledge proof verification for agent executions. Currently uses mock implementation.",
+    "rollout_percentage": 0.0,
+    "whitelisted_users": [],
+    "blacklisted_users": [],
+    "enabled_since": null
+  },
+  "enable_marketplace_rate_limiting": {
+    "enabled": true,
+    "description": "Enable rate limiting on marketplace API endpoints.",
+    "rollout_percentage": 100.0,
+    "whitelisted_users": [],
+    "blacklisted_users": [],
+    "enabled_since": "2026-05-24T00:00:00"
+  }
+}