Per-account limits on repositories and apps: the count is checked before creating, and the refusal names it #973

Pillar: P0 Trust (#586). Replaces #657 (trevato's ask). Previews, runs and checks are #918. Storage is #919. Both wait on this issue.

Waits for #896 and the two flake fixes linked below, so a red check on this pull means this pull is wrong. Pull #961 is the last try.

Why it was parked twice: the first run ran out of time. The second, pull #916, touched ten files across all six quotas, added no test, and its check failed. It also conflicts with main in src/actions/apps.ts, src/checks/service.ts and src/crew/dispatch.ts. Six quotas is more than one run.

Split:

• Live previews, concurrent runs and concurrent checks are now #918.
• Storage is now #919.

Both wait on this issue.

Done looks like (replaces the list above)

• [ ] src/core/quotas.ts holds per-account quota settings with defaults: repositories, apps, and room for #918 and #919's keys. The owner changes them from the admin settings page and PATCH /api/v1/admin/settings, and every change is recorded in the audit.
• [ ] Creating a repository (including a fork or a "make it yours" copy) or an app checks the count first. The refusal names the limit and the current count, for example "10 of 10 repositories", as a clear 4xx on the API and a plain sentence on the page.
• [ ] Forge admins and the owner's own account aren't limited.
• [ ] Test (test/quotas.test.ts, listed in GATE in scripts/gate.ts): a fresh account hits both limits and is refused past them, while the owner's account is unaffected.
• [ ] Start from today's main. #916's src/core/quotas.ts may be reused. Don't rebuild the repo, run or repo_crew tables, because the steward's triggers live on them.
• [ ] Before pushing, run the full check (forge.json's check) and bun x tsc --noEmit, and quote both in the pull.

🤖 Generated with Claude Code

🤖 Generated with Claude Code

Parked by the crew: the check failed ("the studio, continued > the door reads public apps, not a window of the newest repositories, and shows only the live ones (#288, #686)") and the decider saw no point in another try (pull #1158 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("the graph > past eight repositories the smallest share one series") and the decider saw no point in another try (pull #2086 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the studio, continued > the door reads public apps, not a window of the newest repositories, and shows only the live ones (#288, #686)") and the decider saw no point in another try (pull #1158 closed)
2. the check failed ("the graph > past eight repositories the smallest share one series") and the decider saw no point in another try (pull #2086 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #2092 (quota settings, no limit by default, nothing enforced), #2093 (repository limit enforced) and #2094 (app limit enforced). Both tries broke unrelated suites (fleet-graph, studio-changes) because default limits capped accounts that create many repositories. Now nothing is limited until the owner sets a limit. #918 and #919 and #663 now wait on the enforcing parts.