feat(tenant): per-tenant brand and question limit overrides

Add nullable brand_limit / question_limit columns on tenants so ops
admins can override the plan-derived brand-library quotas per account.
When set, these take precedence over config.yml plan defaults across the
brand-library summary, question materialization, and the daily
monitoring worker's primary-client plan resolution.

Ops side exposes them on admin-user create plus a new
PUT /admin-users/:id/limits endpoint, invalidating the brand-library
summary cache on change. The ops-web AdminUsers view gains matching
inputs on the create and edit modals.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/migrations/20260723100000_add_tenant_brand_question_limits.down.sql

@@ -0,0 +1,5 @@
+ALTER TABLE tenants
+DROP CONSTRAINT IF EXISTS chk_tenants_question_limit_positive,
+DROP CONSTRAINT IF EXISTS chk_tenants_brand_limit_positive,
+DROP COLUMN IF EXISTS question_limit,
+DROP COLUMN IF EXISTS brand_limit;

server/migrations/20260723100000_add_tenant_brand_question_limits.up.sql

@@ -0,0 +1,7 @@
+ALTER TABLE tenants
+ADD COLUMN brand_limit INT,
+ADD COLUMN question_limit INT,
+ADD CONSTRAINT chk_tenants_brand_limit_positive
+    CHECK (brand_limit IS NULL OR brand_limit > 0),
+ADD CONSTRAINT chk_tenants_question_limit_positive
+    CHECK (question_limit IS NULL OR question_limit > 0);