I'd like to enable bluetooth manually (using its applet) only when needed.

However, the option "turn bluetooth off" only works until I suspend or reboot my laptop. I tried unchecking "powered" in "configure bluetooth > adapters" but it keeps reverting to enabled.

Is there a way to make the changes permanent so that KDE starts with bluetooth disabled but available (i.e. WITHOUT rfkill'ing bluetooth or blacklisting its module) ?

I'm afraid our Bluetooth system doesn't seem to be able to do this at the moment.
You could inspect the BlueZ interface over D-Bus and try to script this - and have that run on boot.