feat: add operator endpoint to update tenant quotas

[dennisonbertram]

Problem

Operators currently need direct SQL access to adjust tenant quotas (max services, max databases, max builds). The API should be the primary interface for all administrative operations.

Proposed Solution

PATCH /v1/tenants/{tenantID}/quotas

Authenticated with bootstrap token via X-Bootstrap-Token header (same pattern as POST /v1/tenant/reactivate).

Request body (all fields optional — only specified fields are updated):

{
  "max_services": 20,
  "max_databases": 10,
  "max_builds_concurrent": 3,
  "max_env_vars_per_service": 200
}

Response: updated tenant object with new quotas.

Validation:

• All values must be positive integers
• max_services cap: 100
• max_databases cap: 50
• max_builds_concurrent cap: 10
• max_env_vars_per_service cap: 500
• Returns 400 if values exceed caps

Implementation Notes

• Add handler in internal/api/tenants.go
• Reuse validateBootstrapToken() for auth
• Add UpdateQuotas(tenantID string, quotas QuotaUpdate) to the store
• Log quota changes at AUDIT level

Acceptance Criteria

• PATCH /v1/tenants/{tenantID}/quotas updates specified quota fields
• Bootstrap token authentication required
• Validation rejects negative values and values exceeding caps
• Only specified fields are updated (partial update)
• AUDIT log entry on quota change
• Unit tests for handler and store
• API reference updated

[dennisonbertram]

PR created: #145