feat(tenant): per-tenant brand and question limit overrides

Add nullable brand_limit / question_limit columns on tenants so ops
admins can override the plan-derived brand-library quotas per account.
When set, these take precedence over config.yml plan defaults across the
brand-library summary, question materialization, and the daily
monitoring worker's primary-client plan resolution.

Ops side exposes them on admin-user create plus a new
PUT /admin-users/:id/limits endpoint, invalidating the brand-library
summary cache on change. The ops-web AdminUsers view gains matching
inputs on the create and edit modals.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/question_expansion_service.go

@@ -133,7 +133,7 @@ type questionBrandContext struct {
 	BrandName       string
 	Website         *string
 	Description     *string
-	PlanCode        string
+	QuestionLimit   int
 	CompetitorNames []string
 }
 
@@ -473,7 +473,7 @@ func (s *QuestionExpansionService) MaterializeQuestions(ctx context.Context, bra
 		return nil, err
 	}
 
-	maxQuestions := s.brand.currentLimits().QuestionLimitForPlan(brandCtx.PlanCode)
+	maxQuestions := brandCtx.QuestionLimit
 	remaining := maxQuestions - currentCount
 	if remaining < 0 {
 		remaining = 0
@@ -663,7 +663,7 @@ func (s *QuestionExpansionService) loadQuestionBrandContext(ctx context.Context,
 		BrandName:       brandName,
 		Website:         website,
 		Description:     description,
-		PlanCode:        plan.PlanCode,
+		QuestionLimit:   resolveBrandLibraryLimits(s.brand.currentLimits(), plan).MaxQuestions,
 		CompetitorNames: competitors,
 	}, nil
 }