[api] add an `enabled` flag to the query that defaults to true, ensures we only get enabled pagelets by default on find