Providers can now skip optional work (network calls, paid API hits) for
rules the host has disabled. The /collect request grows an EnabledRules
field, and server.handleCollect attaches it to the context with
WithEnabledRules; providers read it via EnabledRulesFromContext or the
per-rule RuleEnabled helper.
