docs+ui(resources): document sandbox quotas, and finish the UI they point at

[HYChou0515]

Documents the sandbox resource quotas, which have shipped since #688 and had no
usage documentation — and finishes the two frontend gaps that writing the guide
exposed.

Why

docs/adding-an-app.md never mentioned resources. docs/configuration.md had
two rows in a lookup table and no section. Predictably, none of the four
built-in Apps declares any — the capability is complete and unused.

What

adding-an-app.md — the app.json half: the block, the per-dimension
fall-through, and three things worth knowing before touching it.

• exceeding resources.per_app.max fails at boot, not by silent trimming
• cpu/memory are enforced by the sandbox backend, so an http deployment
  must redeploy sandbox-host or the declaration does nothing
• disk: "0" means unlimited; cpu: 0 means unset — deliberately asymmetric

configuration.md §6.5 — numbered like the file's existing 11.5 so §7–§14
keep their numbers. Three-layer resolution; the stock-vs-flow split that
explains why disk and cpu behave differently; the four per_user dimensions;
and the per-person override, which is superuser API only, has no UI, and
answers 404 rather than 403 so "who has an exception" doesn't leak.

Also points the three quick-reference rows at the new section and adds one for
the override.

Verified against a running server, not against the plan

Brought the app up with per_user.count: 1, took the real 507, and drove the
recovery in a browser. The error payload, the page's own wording, and the whole
loop are quoted from what happened:

507 {"error":"sandbox_quota_exceeded","dimension":"sandboxes","used":2,"limit":1.0}
  → /my-resources shows "Live environments 1 / 1"
  → click Close → "0 / 1 · No live environments"
  → same exec returns 200

Then: the two things documenting it exposed

Writing the guide from a running server surfaced two places where the frontend
had stopped one step short of the backend, so this branch finishes them rather
than documenting them as caveats.

/my-resources had no stylesheet. It shipped a full vocabulary of semantic
classes and not one was ever defined — Meter was two zero-height divs, so a
person could not see how close to the limit they were, and each row read as one
run of text. This is the page every quota refusal routes to (#692).

Per-person allowances had no UI. P7 delivered the model, the two-layer read
and three admin routes and called that the "admin entry point", but only someone
who writes curl could use it. A superuser now gets a section on the same page;
everyone else sees nothing, matching the backend's 404-not-403.

The form starts empty rather than pre-filling from current numbers: PUT
replaces all four dimensions and the read returns EFFECTIVE limits, so
pre-filling would submit inherited values back as explicit overrides and pin
them. There is a test for that specifically.

Verified in both themes in a real browser — dark masks light-mode palette
defects, not the other way round — and the whole loop driven from the UI:
refused 507 → raise the allowance in the form → same call returns 200. A
wrapping bug was found that way and fixed.

Still true, and stated in the guide

Every quota here is currently bypassable. owner is the debtor, it is still
editable by anyone, and it is not the permission holder (#687 is open). The plan
calls this a known trade; a config guide that omitted it would be selling
enforcement that isn't there.

348 files / 2872 tests green; tsc clean; mkdocs build --strict clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LJagZZoJ8jKF7QsQAM56tC