Per-account limits on live previews, concurrent runs and concurrent checks, refused with the count before anything starts #918

Under P0 Trust: split from #657, which was parked twice. This one bounds what an account can have running at once: live previews, concurrent runs and concurrent checks.

Pull #916 (branch scout/657-per-account-quotas-repositories-apps-pre) sketched these checks in src/apps/runtime.ts, src/crew/dispatch.ts and src/checks/service.ts, but it had no tests and its check failed. Start from today's main after #657 lands, and use #916 only as a reference.

Done looks like

• [ ] Per-account limits on live previews, concurrent runs and concurrent checks, read from the quota settings #657 adds (src/core/quotas.ts), with defaults the owner can change.
• [ ] Each one is checked before the thing starts. A refused preview, run or check doesn't start, and its message names the limit and the current count, for example "3 of 3 live previews". A run or check that's refused is queued or ends with that message; it is never silently dropped.
• [ ] Forge admins and the owner's own account aren't limited, as in #657.
• [ ] Test (test/quotas-running.test.ts, listed in GATE): a fresh account hits each limit and is refused past it, while the owner's account starts the same things freely. Waits are explicit, not timing races (see #896).
• [ ] Before pushing, run the full check (forge.json's check) and bun x tsc --noEmit, and quote both in the pull.

Files

src/core/quotas.ts, src/apps/runtime.ts, src/crew/dispatch.ts, src/checks/service.ts, test/quotas-running.test.ts, scripts/gate.ts.

Risks

Previews start from pushes. A refused preview must say so on the pull rather than leave it waiting forever.

Suggested: scout.