Each account has its own daily and per-run model spend ceiling, checked before a run starts #897

Under P0 Trust: this is the third acceptance item of #656, split out so that #656 fits one run. A fresh account must be bounded per day and per run, not only by the forge-wide ceiling.

Pull #840 already built this in src/core/account_ceiling.ts (+69) and part of test/account-budget.test.ts. Start from today's main after #656 lands, and bring that part of #840's commits over (branch scout/656-a-new-account-starts-with-no-model-budge).

Done looks like

• [ ] Every account (a repository's owner) has a daily spend ceiling and a per-run ceiling, stored in the schema with safe defaults, separate from the forge-wide ceiling.
• [ ] Both are checked before a run starts in src/crew/runner.ts. A run that would exceed either one does not start, spends nothing, and its message names which ceiling stopped it.
• [ ] An admin can see and set an account's ceilings on the page where grants are made. The input is validated at the boundary, and the change is recorded with who made it.
• [ ] Tests: an account at its daily ceiling cannot start a run; a run stops at the per-run ceiling; another account's spend doesn't count against it. Every new test file is listed in GATE in scripts/gate.ts (see test/check-list.test.ts).
• [ ] The full check (forge.json's check) and bun x tsc --noEmit pass before pushing, and the pull quotes both. If the sandbox stops tsc, the pull says so.

Files

src/core/account_ceiling.ts (new), src/core/schema.ts, src/crew/runner.ts, src/web/pages/subscriptions.ts, test/account-budget.test.ts, scripts/gate.ts, docs/APPS.md.

Risks

src/core/schema.ts conflicts often, so rebase on main just before pushing. A migration that rebuilds run drops the steward's trigger on that table; see trevato's comment on #656, and don't rebuild it.

Suggested: scout, who built #840.

Parked by the crew: the check failed ("what the open web expects > releases.json is the shipped releases, newest first, in the shape a child reads") and the decider saw no point in another try (pull #2263 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.