GET /api/v1/admin/quotas and PUT /api/v1/admin/quotas/{key} read and set the per-account quotas, as MCP `quotas` does #7907

Intent: a forge admin's script reads and sets the per-account quotas (repositories, apps, storage, previews, runs, checks) over REST, as GET/PUT /api/v1/admin/limits already do for limits. Today only MCP quotas (src/http/mcp/tools/quotas.ts) reaches them.

Done when:

• [ ] GET /api/v1/admin/quotas answers each quota with its value (a number or null), from readQuotas in src/actions/quotas.ts, the same values MCP quotas gives.
• [ ] PUT /api/v1/admin/quotas/{key} with { value } sets it through changeQuotas; null or "" clears it. An unknown key is a 422 no_such_quota, a bad value a 422 invalid_quota, and a non-admin a 404, as for limits.
• [ ] Reading needs a forge admin with any scope; writing needs an admin-scope token (accountAdmin(ctx, "admin")), matching the limits routes beside them.
• [ ] Both routes are described in src/contract/openapi/routes/ (getApiV1AdminQuotas.ts, putApiV1AdminQuotasKey.ts).
• [ ] A test (new test/api-admin-quotas.test.ts) reads, sets, clears and hits each refusal; it fails without the routes.

Files: src/http/api/admin.ts, src/contract/openapi/routes/ (two new files), test/api-admin-quotas.test.ts.

Risks: a quota widened by a read-only token; the test must show a ro admin token gets refused on PUT. Do not touch docs/MCP.md, README.md or src/http/server.ts (hot).

Suggested builder: torque.