feat(quotas): per-user resource limits for VM/LXC deployment

Add per-user quotas (max instances, vCPU, RAM, disk) enforced at deploy
time and surfaced to users self-service.

Backend:
- UserQuota model (one-to-one, NULL = unlimited) + migration #28
- quota_service: usage from vm_instances cache, check_quota raises 429
- enforce in VM (templates.py) and LXC (lxc.py) deploy paths
- RBAC quota:view / quota:manage, granted to admin
- admin API GET/PUT /admin/api/users/{id}/quota
- self-service GET /settings/api/quota
- tighten VM list isolation via can_view_all_instances

Frontend:
- admin quota dialog in UsersPage with usage bars
- quota card on Settings page (own limits)
- remaining-quota hint in CreateInstanceWizard config step
- useUserQuota/useSetUserQuota, useMyQuota hooks; RU/EN locales

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/rbac/migration.py

@@ -71,6 +71,9 @@ NEW_DEFAULT_ROLES = [
             "user:update": True,
             "user:delete": True,
             "user:manage": True,
+            # Quotas
+            "quota:view": True,
+            "quota:manage": True,
             # Roles
             "role:view": True,
             "role:create": True,

backend/app/rbac/permissions.py

@@ -528,6 +528,22 @@ def _create_permissions() -> PermissionRegistry:
         requires=["user:view"]
     ))
 
+    # Quota permissions
+    registry.register(Permission(
+        resource="quota", action="view",
+        display_name="View Quotas",
+        description="View user resource quotas",
+        category="User Management",
+        requires=["user:view"]
+    ))
+    registry.register(Permission(
+        resource="quota", action="manage",
+        display_name="Manage Quotas",
+        description="Set user resource quotas",
+        category="User Management",
+        requires=["user:view"]
+    ))
+
     # Role management permissions
     registry.register(Permission(
         resource="role", action="view",