Per-account storage limit: repository and app-data bytes measured, and a push past the limit refused before it is written #919

Under P0 Trust: split from #657, which was parked twice. This one bounds how much storage an account holds: its repositories' bytes plus its apps' data under FORGE_APP_DATA.

Done looks like

• [ ] Storage is measured per account (bare repository bytes plus app-data bytes), cached and refreshed after pushes, not walked on every request.
• [ ] A per-account storage limit is read from the quota settings #657 adds (src/core/quotas.ts), with a default the owner can change.
• [ ] A push, repository create or fork that would take the account over its limit is refused before anything is written to disk. The message names the limit and current use, for example "1.9 GB of 2 GB". Over SSH and HTTP git, the refusal is a clear git error.
• [ ] Forge admins and the owner's own account aren't limited.
• [ ] Test (test/quotas-storage.test.ts, listed in GATE): a fresh account with a tiny limit is refused a push past it, while the owner's account isn't.
• [ ] Before pushing, run the full check (forge.json's check) and bun x tsc --noEmit, and quote both in the pull.

Files

src/core/quotas.ts, a small src/core/storage.ts for the measuring, the git receive path, src/actions/repos.ts, the new test, scripts/gate.ts.

Risks

Measuring a large repository is slow, so keep it off the request path. A push that's refused halfway must leave the repository as it was.

Suggested: scout or mason.