fix: harden quota management contract

[dadachann]

Summary

• protect quota, used quota, and request count from generic user edits
• make quota add/subtract/override atomic and return the committed authoritative quota
• invalidate cached user data after quota mutation

Verification

• go test ./controller -run TestManageUser -count=1
• focused quota/model tests
• broader go test ./controller ./model -count=1 was attempted; controller passed, while unrelated existing model tests fail because their shared SQLite setup lacks tables such as abilities and tasks
• git diff --check

Checklist

• Human-reviewed implementation and tests
• No unrelated UI changes
• Backward-compatible API route and authorization

[dadachann]

Re-triggering the opened-only PR quality workflow after the final idempotency changes.

[dadachann]

Re-triggering the opened-only PR quality workflow for the final review-gap commit.

[dadachann]

Re-triggering the opened-only workflow for the final audit-recovery commit.